aftermath: Swift-based, open-source macOS incident response framework

Aftermath

Aftermath is a Swift-based, open-source incident response framework.

Aftermath can be leveraged by defenders in order to collect and subsequently analyze the data from the compromised host. Aftermath can be deployed from an MDM (ideally), but it can also run independently from the infected user’s command line.

Aftermath first runs a series of modules for collection. The output of this will either be written to the location of your choice, via the -o or –output option, or by default, it is written to the /tmp directory.

Once the collection is complete, the final zip/archive file can be pulled from the end user’s disk. This file can then be analyzed using the –analyze argument pointed at the archive file. The results of this will be written to the /tmp directory. The administrator can then unzip that analysis directory and see a parsed view of the locally collected databases, a timeline of files with the file creation, last accessed, and last modified dates (if they’re available), and a storyline which includes the file metadata, database changes, and browser information to potentially track down the infection vector.

File Collection List

• Artifacts
  • Configuration Profiles
  • Log Files
  • LSQuarantine Database
  • Shell History and Profiles (bash, csh, fish, ksh, zsh)
  • TCC Database
  • XBS Database (XProtect Behabioral Service)
• Filesystem
  • Browser Data (Cookies, Downloads, Extensions, History)
    • Arc
    • Brave
    • Chrome
    • Edge
    • Firefox
    • Safari
  • File Data
    • Walk common directories to get accessed, birth, modified timestamps
  • Slack
• Network
  • Active network connections
  • Airport Preferences
• Persistence
  • BTM Database
  • Cron
  • Emond
  • Launch Items
    • Launch Agents
    • Launch Daemons
  • Login Hooks
  • Login Items
  • Overrides
    • launchd Overrides
    • MDM Overrides
  • Periodic Scripts
  • System Extensions
• Processes
  • Leverage TrueTree to create process tree
• System Recon
  • Environment Variables
  • Install History
  • Installed Applications
  • Installed Users
  • Interfaces
  • MRT Version
  • Running Applications
  • Security Assessment (SIP status, Gatekeeper status, Firewall status, Filevault status, Remote Login, Airdrop status, I/O statistics, Screensharing status, Login History, Network Interface Parameters)
  • XProtect Version
  • XProtect Remediator (XPR) Version
• Unified Logs
  • Default Unified Logs (failed_sudo, login, manual_configuration_profile_install, screensharing, ssh, tcc, xprotect_remediator)
  • Additional can be passed in at runtime

Usage

Aftermath needs to be rooted, as well as full disk access (FDA) in order to run. FDA can be granted to the Terminal application in which it is running.

The default usage of Aftermath runs

sudo ./aftermath

To specify certain options

sudo ./aftermath [option1] [option2]

Examples

sudo ./aftermath -o /Users/user/Desktop --deep

sudo ./aftermath --analyze <path_to_collection_zip>

Download

Copyright 2022 JAMF Software, LLC