{"id":15116641,"url":"https://github.com/jamf/aftermath","last_synced_at":"2025-05-15T19:03:27.031Z","repository":{"id":60920519,"uuid":"429659702","full_name":"jamf/aftermath","owner":"jamf","description":"Aftermath is a free macOS IR framework","archived":false,"fork":false,"pushed_at":"2024-11-25T21:03:04.000Z","size":915,"stargazers_count":498,"open_issues_count":4,"forks_count":35,"subscribers_count":15,"default_branch":"main","last_synced_at":"2025-04-03T05:09:35.815Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"Swift","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/jamf.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE.md","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":"CODEOWNERS","security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2021-11-19T03:37:27.000Z","updated_at":"2025-03-21T13:27:36.000Z","dependencies_parsed_at":"2024-01-12T19:09:23.127Z","dependency_job_id":"70b8a4ca-4938-448f-997d-cabb12d35c23","html_url":"https://github.com/jamf/aftermath","commit_stats":null,"previous_names":[],"tags_count":10,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jamf%2Faftermath","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jamf%2Faftermath/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jamf%2Faftermath/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jamf%2Faftermath/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/jamf","download_url":"https://codeload.github.com/jamf/aftermath/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":248489309,"owners_count":21112545,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-09-26T01:44:29.082Z","updated_at":"2025-04-11T22:29:54.348Z","avatar_url":"https://github.com/jamf.png","language":"Swift","funding_links":[],"categories":["Swift"],"sub_categories":[],"readme":"\n![](https://github.com/jamf/aftermath/blob/main/AftermathLogo.png)\n\n\n![](https://img.shields.io/badge/release-2.2.1-bright%20green)\u0026nbsp;![](https://img.shields.io/badge/macOS-12.0%2B-blue)\u0026nbsp;![](https://img.shields.io/badge/license-MIT-orange)\n\n\n## About\nAftermath is a  Swift-based, open-source incident response framework.\n\nAftermath can be leveraged by defenders in order to collect and subsequently analyze the data from the compromised host. Aftermath can be deployed from an MDM (ideally), but it can also run independently from the infected user's command line. \n\nAftermath first runs a series of modules for collection. The output of this will either be written to the location of your choice, via the `-o` or `--output` option, or by default, it is written to the `/tmp` directory.\n\nOnce collection is complete, the final zip/archive file can be pulled from the end user's disk. This file can then be analyzed using the `--analyze` argument pointed at the archive file. The results of this will be written to the `/tmp` directory. The administrator can then unzip that analysis directory and see a parsed view of the locally collected databases, a timeline of files with the file creation, last accessed, and last modified dates (if they're available), and a storyline which includes the file metadata, database changes, and browser information to potentially track down the infection vector.\n\n\n## Build\nTo build Aftermath locally, clone it from the repository\n```bash\ngit clone https://github.com/jamf/aftermath.git\n```\n`cd` into the Aftermath directory\n```bash\ncd \u003cpath_to_aftermath_directory\u003e\n```\nBuild using Xcode\n```bash\nxcodebuild -scheme \"aftermath\"\n``` \n`cd` into the Release folder\n```bash\ncd build/Release\n```\nRun aftermath\n```bash\nsudo ./aftermath\n```\n\n## Usage\nAftermath needs to be root, as well as have *full disk access (FDA)* in order to run. FDA can be granted to the Terminal application in which it is running.\n\nThe default usage of Aftermath runs \n```bash\nsudo ./aftermath\n```\nTo specify certain options\n```bash\nsudo ./aftermath [option1] [option2]\n```\nExamples\n```bash\nsudo ./aftermath -o /Users/user/Desktop --deep\n```\n```bash\nsudo ./aftermath --analyze \u003cpath_to_collection_zip\u003e\n```\n\n### External Unified Log Predicates\nUsers have the ability to pass Aftermath a text file of unified log predicates using the `--logs` or `-l` arguments. The file being passed to Aftermath is required to be a text file and each predicate needs to be newline-separated. In addition, each line item will be a dictionary object. The key in the dictionary will whatever the user desires to call this predicate. For example, if you want to see all login events, we will create a predicate and title it `login_events`.\n```\nlogin_events: processImagePath contains \"loginwindow\" and eventMessage contains \"com.apple.sessionDidLogin\ntcc: process == \"tccd\"\n```\n\n### Note\nBecause `eslogger` and `tcpdump` run on additional threads and the goal is to collect as much data from them as possible, they exit when aftermath exits. Because of this, the last line of the eslogger json file or the pcap file generated from tcpdump may be truncated.\n\n### File Collection List\n- Artifacts\n    - Configuration Profiles\n    - Log Files\n    - LSQuarantine Database\n    - Shell History and Profiles (bash, csh, fish, ksh, zsh)\n    - TCC Database\n    - XBS Database (XProtect Behabioral Service)\n- Filesystem\n    - Browser Data (Cookies, Downloads, Extensions, History)\n        - Arc\n        - Brave\n        - Chrome\n        - Edge\n        - Firefox\n        - Safari\n    - File Data\n        - Walk common directories to get accessed, birth, modified timestamps\n    - Slack\n- Network\n    - Active network connections\n    - Airport Preferences\n- Persistence\n    - BTM Database\n    - Cron\n    - Emond\n    - Launch Items\n        - Launch Agents\n        - Launch Daemons\n    - Login Hooks\n    - Login Items\n    - Overrides\n        - launchd Overrides\n        - MDM Overrides\n    - Periodic Scripts\n    - System Extensions\n- Processes\n    - Leverage [TrueTree](https://github.com/themittenmac/TrueTree) to create process tree \n- System Recon\n    - Environment Variables\n    - Install History\n    - Installed Applications\n    - Installed Users\n    - Interfaces\n    - MRT Version\n    - Running Applications\n    - Security Assessment (SIP status, Gatekeeper status, Firewall status, Filevault status, Remote Login, Airdrop status, I/O statistics, Screensharing status, Login History, Network Interface Parameters)\n    - XProtect Version\n    - XProtect Remediator (XPR) Version\n- Unified Logs\n    - Default Unified Logs (failed_sudo, login, manual_configuration_profile_install, screensharing, ssh, tcc, xprotect_remediator)\n    - Additional can be passed in at runtime\n\n## Releases\nThere is an Aftermath.pkg available under [Releases](https://github.com/jamf/aftermath/releases). This pkg is signed and notarized. It will install the aftermath binary at `/usr/local/bin/`. This would be the ideal way to deploy via MDM. Since this is installed in `bin`, you can then run aftermath like\n```bash\nsudo aftermath [option1] [option2]\n```\n\n## Uninstall\nTo uninstall the aftermath binary, run the `AftermathUninstaller.pkg` from the [Releases](https://github.com/jamf/aftermath/releases). This will uninstall the binary and also run `aftermath --cleanup` to remove aftermath directories. If any aftermath directories reside elsewhere, from using the `--output` command, it is the responsibility of the user/admin to remove said directories.\n\n## Help Menu\n\n```\n--analyze -\u003e analyze the results of the Aftermath results\n     usage: --analyze \u003cpath_to_aftermath_collection_file\u003e\n--collect-dirs -\u003e specify locations of (space-separated) directories to dump those raw files\n    usage: --collect-dirs \u003cpath_to_dir\u003e \u003cpath_to_another_dir\u003e\n--deep or -d -\u003e perform a deep scan of the file system for modified and accessed timestamped metadata\n    WARNING: This will be a time-intensive, memory-consuming scan.\n--disable -\u003e disable a set of aftermath features that may collect personal user data\n    Available features to disable: browsers -\u003e collecting browser information | browser-killswitch -\u003e force-closes browers | -\u003e databases -\u003e tcc \u0026 lsquarantine databases | filesystem -\u003e walking the filesystem for timestamps | proc-info -\u003e collecting process information via TrueTree and eslogger | slack -\u003e slack data | ul -\u003e unified logging modules | all -\u003e all aforementioned options \n    usage: --disable browsers browser-killswitch databases filesystem proc-info slack\n           --disable all\n--es-logs -\u003e specify which Endpoint Security events (space-separated) to collect (defaults are: create exec mmap). To disable, see --disable es-logs\n    usage: --es-logs setuid unmount write\n--logs -\u003e specify an external text file with unified log predicates (as dictionary objects) to parse\n    usage: --logs /Users/\u003cUSER\u003e/Desktop/myPredicates.txt\n-o or --output -\u003e specify an output location for Aftermath collection results (defaults to /tmp)\n     usage: -o Users/user/Desktop\n--pretty -\u003e colorize Terminal output\n--cleanup -\u003e remove Aftermath folders from default locations (\"/tmp\", \"/var/folders/zz/) \n```\n\n## Contributors\n- Stuart Ashenbrenner\n- Jaron Bradley\n- Maggie Zirnhelt\n- Matt Benyo\n- Ferdous Saljooki\n\n## Thank You\nThis project leverages the open source [TrueTree](https://github.com/themittenmac/TrueTree) project, written and [licensed](https://github.com/themittenmac/TrueTree/blob/master/license.md) by Jaron Bradley. \n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fjamf%2Faftermath","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fjamf%2Faftermath","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fjamf%2Faftermath/lists"}