Aftermath is a Swift-based, open-source incident response framework.<\/p>\n\n\n\n
Aftermath can be leveraged by defenders in order to collect and subsequently analyze the data from the compromised host. Aftermath can be deployed from an MDM (ideally), but it can also run independently from the infected user’s command line.<\/p>\n\n\n\n
Aftermath first runs a series of modules for collection. The output of this will either be written to the location of your choice, via the Once collection is complete, the final zip\/archive file can be pulled from the end user’s disk. This file can then be analyzed using the The administrator can then unzip that analysis directory and see a parsed view of the locally collected databases, a timeline of files with the file creation, last accessed, and last modified dates (if they’re available), and a storyline which includes the file metadata, database changes, and browser information to potentially track down the infection vector.<\/p>\n\n\n\n To build Aftermath locally, clone it from the repositorygit clone https:\/\/github.com\/jamf\/aftermath.git<\/p>\n\n\n\n Build using Xcodexcodebuild -scheme “aftermath”<\/p>\n\n\n\n Run aftermathsudo .\/aftermath<\/p>\n\n\n\n Aftermath needs to be root, as well as have full disk access (FDA)<\/em> in order to run. FDA can be granted to the Terminal application in which it is running.<\/p>\n\n\n\n The default usage of Aftermath runssudo .\/aftermath<\/p>\n\n\n\n To specify certain optionssudo .\/aftermath [option1] [option2]<\/p>\n\n\n\n Examplessudo .\/aftermath -o \/Users\/user\/Desktop –deepsudo .\/aftermath –analyze <path_to_collection_zip><\/p>\n\n\n\n Users have the ability to pass Aftermath a text file of unified log predicates using the In addition, each line item will be a dictionary object. The key in the dictionary will whatever the user desires to call this predicate. <\/p>\n\n\n\n For example, if you want to see all login events, we will create a predicate and title it Because There is an Aftermath.pkg available under Releases<\/a>. This pkg is signed and notarized. It will install the aftermath binary at This would be the ideal way to deploy via MDM. Since this is installed in To uninstall the aftermath binary, run the -o<\/code> or --output<\/code> option, or by default, it is written to the \/tmp<\/code> directory.<\/p>\n\n\n\n--analyze<\/code> argument pointed at the archive file. The results of this will be written to the \/tmp<\/code> directory. <\/p>\n\n\n\nBuild<\/a><\/strong><\/h2>\n\n\n\n
cd<\/code> into the Aftermath directorycd <path_to_aftermath_directory><\/p>\n\n\n\ncd<\/code> into the Release foldercd build\/Release<\/p>\n\n\n\nUsage<\/a><\/strong><\/h2>\n\n\n\n
External Unified Log Predicates<\/strong><\/a><\/h2>\n\n\n\n
--logs<\/code> or -l<\/code> arguments. The file being passed to Aftermath is required to be a text file and each predicate needs to be newline-separated. <\/p>\n\n\n\nlogin_events<\/code>.<\/p>\n\n\n\nlogin_events: processImagePath contains \"loginwindow\" and eventMessage contains \"com.apple.sessionDidLogin\ntcc: process == \"tccd\"<\/code><\/pre>\n\n\n\nNote<\/strong><\/a><\/h2>\n\n\n\n
eslogger<\/code> and tcpdump<\/code> run on additional threads and the goal is to collect as much data from them as possible, they exit when aftermath exits. Because of this, the last line of the eslogger json file or the pcap file generated from tcpdump may be truncated.<\/p>\n\n\n\nReleases<\/a><\/strong><\/h2>\n\n\n\n
\/usr\/local\/bin\/<\/code>. <\/p>\n\n\n\nbin<\/code>, you can then run aftermath likesudo aftermath [option1] [option2]<\/p>\n\n\n\nUninstall<\/a><\/strong><\/h2>\n\n\n\n
AftermathUninstaller.pkg<\/code> from the Releases<\/a>. This will uninstall the binary and also run aftermath --cleanup<\/code> to remove aftermath directories. <\/p>\n\n\n\n