New functionality and bug fixes

README.md

@@ -2,7 +2,7 @@
 ![](https://github.com/jamf/aftermath/blob/main/AftermathLogo.png)
 
 
-![](https://img.shields.io/badge/release-2.0.0-bright%20green) ![](https://img.shields.io/badge/macOS-12.0%2B-blue) ![](https://img.shields.io/badge/license-MIT-orange)
+![](https://img.shields.io/badge/release-2.1.0-bright%20green) ![](https://img.shields.io/badge/macOS-12.0%2B-blue) ![](https://img.shields.io/badge/license-MIT-orange)
 
 
 ## About
@@ -84,14 +84,16 @@ To uninstall the aftermath binary, run the `AftermathUninstaller.pkg` from the [
     usage: --collect-dirs <path_to_dir> <path_to_another_dir>
 --deep or -d -> perform a deep scan of the file system for modified and accessed timestamped metadata
     WARNING: This will be a time-intensive, memory-consuming scan.
- --es-logs -> specify which Endpoint Security events (space-separated) to collect (defaults are: create exec mmap). To disable, see --disable-es-logs
+--disable -> disable a set of aftermath features that may collect personal user data
+    Available features to disable: browsers -> collecting browser information | browser-killswitch -> force-closes browers | -> databases -> tcc & lsquarantine databases | filesystem -> walking the filesystem for timestamps | proc-info -> collecting process information via TrueTree and eslogger | all -> all aforementioned options 
+    usage: --disable browsers browser-killswitch databases filesystem proc-info
+           --disable all
+--es-logs -> specify which Endpoint Security events (space-separated) to collect (defaults are: create exec mmap). To disable, see --disable es-logs
     usage: --es-logs setuid unmount write
 --logs -> specify an external text file with unified log predicates (as dictionary objects) to parse
     usage: --logs /Users/<USER>/Desktop/myPredicates.txt
 -o or --output -> specify an output location for Aftermath collection results (defaults to /tmp)
      usage: -o Users/user/Desktop
---disable-browser-killswitch -> by default, browsers are force-closed during collection. This will disable the force-closing of browsers.
---disable-es-logs -> by default, es logs of create, exec, and mmap are collected. This will disable this default behavior
 --pretty -> colorize Terminal output
 --cleanup -> remove Aftermath folders from default locations ("/tmp", "/var/folders/zz/) 
 ```

aftermath.xcodeproj/project.pbxproj

@@ -16,6 +16,7 @@
 		5E93B0AE2941608D009D2AB5 /* Data.swift in Sources */ = {isa = PBXBuildFile; fileRef = 5E93B0AD2941608D009D2AB5 /* Data.swift */; };
 		5E93B0B0294160B6009D2AB5 /* String.swift in Sources */ = {isa = PBXBuildFile; fileRef = 5E93B0AF294160B6009D2AB5 /* String.swift */; };
 		5EA438FF2A7010FF00F3E2B9 /* XProtectBehavioralService.swift in Sources */ = {isa = PBXBuildFile; fileRef = 5EA438FE2A7010FF00F3E2B9 /* XProtectBehavioralService.swift */; };
+		5EFDDCD72AC6661A00EEF193 /* Brave.swift in Sources */ = {isa = PBXBuildFile; fileRef = 5EFDDCD62AC6661A00EEF193 /* Brave.swift */; };
 		70A44403275707A90035F40E /* SystemReconModule.swift in Sources */ = {isa = PBXBuildFile; fileRef = 70A44402275707A90035F40E /* SystemReconModule.swift */; };
 		70A44405275A76990035F40E /* LSQuarantine.swift in Sources */ = {isa = PBXBuildFile; fileRef = 70A44404275A76990035F40E /* LSQuarantine.swift */; };
 		70CF9E3A27611C6100FD884B /* ShellHistoryAndProfiles.swift in Sources */ = {isa = PBXBuildFile; fileRef = 70CF9E3927611C6100FD884B /* ShellHistoryAndProfiles.swift */; };
@@ -90,6 +91,7 @@
 		5E93B0AD2941608D009D2AB5 /* Data.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = Data.swift; sourceTree = "<group>"; };
 		5E93B0AF294160B6009D2AB5 /* String.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = String.swift; sourceTree = "<group>"; };
 		5EA438FE2A7010FF00F3E2B9 /* XProtectBehavioralService.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = XProtectBehavioralService.swift; sourceTree = "<group>"; };
+		5EFDDCD62AC6661A00EEF193 /* Brave.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = Brave.swift; sourceTree = "<group>"; };
 		70A44402275707A90035F40E /* SystemReconModule.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = SystemReconModule.swift; sourceTree = "<group>"; };
 		70A44404275A76990035F40E /* LSQuarantine.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = LSQuarantine.swift; sourceTree = "<group>"; };
 		70CF9E3927611C6100FD884B /* ShellHistoryAndProfiles.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = ShellHistoryAndProfiles.swift; sourceTree = "<group>"; };
@@ -290,6 +292,7 @@
 				A0E1E3EE275EC810008D0DC6 /* Safari.swift */,
 				5E6780F12922E7E800BAF04B /* Edge.swift */,
 				5E4BC8FF29D75A8E0004DAA6 /* Arc.swift */,
+				5EFDDCD62AC6661A00EEF193 /* Brave.swift */,
 			);
 			path = browsers;
 			sourceTree = "<group>";
@@ -520,6 +523,7 @@
 			isa = PBXSourcesBuildPhase;
 			buildActionMask = 2147483647;
 			files = (
+				5EFDDCD72AC6661A00EEF193 /* Brave.swift in Sources */,
 				A3CD4E56274434EE00869ECB /* Command.swift in Sources */,
 				5E494475293D50FE007FFBDD /* ConfigurationProfiles.swift in Sources */,
 				5E4BC90029D75A8E0004DAA6 /* Arc.swift in Sources */,

aftermath/Command.swift

@@ -16,10 +16,8 @@
      static let pretty = Options(rawValue: 1 << 3)
      static let collectDirs = Options(rawValue: 1 << 4)
      static let unifiedLogs = Options(rawValue: 1 << 5)
-     static let disableBrowserKillswitch = Options(rawValue: 1 << 6)
-     static let esLogs = Options(rawValue: 1 << 7)
-     static let disableESLogs = Options(rawValue: 1 << 8)
-
+     static let esLogs = Options(rawValue: 1 << 6)
+     static let disable = Options(rawValue: 1 << 7)
  }
 
 @main
@@ -30,7 +28,8 @@ class Command {
     static var collectDirs: [String] = []
     static var unifiedLogsFile: String? = nil
     static var esLogs: [String] = ["create", "exec", "mmap"]
-    static let version: String = "2.0.0"
+    static let version: String = "2.1.0"
+    static var disableFeatures: [String:Bool] = ["all":false, "browsers":false, "browser-killswitch":false, "databases":false, "filesystem":false, "proc-info":false]
 
     static func main() {
         setup(with: CommandLine.arguments)
@@ -53,7 +52,6 @@ class Command {
              case "--cleanup": Self.cleanup(defaultRun: false)
              case "-d", "--deep": Self.options.insert(.deep)
              case "--pretty": Self.options.insert(.pretty)
-             case "--disable-browser-killswitch": Self.options.insert(.disableBrowserKillswitch)
              case "--analyze":
                  if let index = args.firstIndex(of: arg) {
                      Self.options.insert(.analyze)
@@ -68,7 +66,27 @@ class Command {
                          i += 1
                      }
                  }
-             case "--disable-es-logs": Self.options.insert(.disableESLogs)
+             case "--disable":
+                 if let index = args.firstIndex(of: arg) {
+                     Self.options.insert(.disable)
+                     var i = 1
+                     while (index + i) < args.count && !args[index + i].starts(with: "-") {
+                         for k in self.disableFeatures.keys {
+                             if args[index + i] == "all" {
+                                 for k in self.disableFeatures.keys {
+                                     self.disableFeatures[k] = true
+                                 }
+                                 break
+                             }
+
+                             if args[index + i] == k {
+                                 self.disableFeatures[k] = true
+                                 break
+                             }
+                         }
+                         i += 1
+                     }
+                 }
              case "--es-logs":
                  if let index = args.firstIndex(of: arg) {
                      Self.options.insert(.esLogs)
@@ -138,8 +156,7 @@ class Command {
                  mainModule.log("Aftermath requires macOS 12 or later in order to analyze collection data.")
                  print("Aftermath requires macOS 12 or later in order to analyze collection data.")
              }
-
-             mainModule.log("Finished analysis module")
+
 
              // Move analysis directory to output direcotry
              CaseFiles.MoveTemporaryCaseDir(outputLocation: self.outputLocation, isAnalysis: true)
@@ -155,78 +172,55 @@ class Command {
              mainModule.addTextToFile(atUrl: CaseFiles.metadataFile, text: "file,birth,modified,accessed,permissions,uid,gid,xattr,downloadedFrom")
 
 
-             // Start logging Endpoint Security data
+             // eslogger
              if #available(macOS 13, *) {
-                  // Start logging Endpoint Security data
-                  mainModule.log("Starting ES logging...")
                   let esModule = ESModule()
                   esModule.run()
              } else {
-                 print("Unable to run eslogger due to unavailability on this OS")
+                 print("Unable to run eslogger due to unavailability on this OS. Requires macOS 13 or higher.")
              }
 
 
              // tcpdump
-             mainModule.log("Running pcap...")
              let pcapModule = NetworkModule()
              pcapModule.pcapRun()
 
 
              // System Recon
-             mainModule.log("Started system recon")
              let systemReconModule = SystemReconModule()
              systemReconModule.run()
-             mainModule.log("Finished system recon")
 
 
              // Network
-             mainModule.log("Started gathering network information...")
              let networkModule = NetworkModule()
              networkModule.run()
-             mainModule.log("Finished gathering network information")
 
 
              // Processes
-             mainModule.log("Starting process dump...")
              let procModule = ProcessModule()
              procModule.run()
-             mainModule.log("Finished gathering process information")
 
 
              // Persistence
-             mainModule.log("Starting Persistence Module")
              let persistenceModule = PersistenceModule()
              persistenceModule.run()
-             mainModule.log("Finished logging persistence items")
 
 
              // FileSystem
-             mainModule.log("Started gathering file system information...")
              let fileSysModule = FileSystemModule()
              fileSysModule.run()
-             mainModule.log("Finished gathering file system information")
 
 
              // Artifacts
-             mainModule.log("Started gathering artifacts...")
              let artifactModule = ArtifactsModule()
              artifactModule.run()
-             mainModule.log("Finished gathering artifacts")
 
 
              // Logs
-             mainModule.log("Started logging unified logs")
              let unifiedLogModule = UnifiedLogModule(logFile: unifiedLogsFile)
              unifiedLogModule.run()
-             mainModule.log("Finished logging unified logs")
-
-
-             mainModule.log("Finished running pcap")
-
-
-             // End logging Endpoint Security data
-             mainModule.log("Finished ES logging")
 
+
              mainModule.log("Finished running Aftermath collection")
 
              // Copy from cache to output
@@ -269,12 +263,13 @@ class Command {
          print("--collect-dirs -> specify locations of (space-separated) directories to dump those raw files")
          print("    usage: --collect-dirs /Users/<USER>/Downloads /tmp")
          print("--deep -> performs deep scan and captures metadata from Users entire directory (WARNING: this may be time-consuming)")
+         print("--disable -> disable a set of aftermath features that may collect personal user data")
+         print("    usage: --disable browsers browser-killswitch databases filesystem proc-info")
+         print("           --disable all")
          print("--es-logs -> specify which Endpoint Security events (space-separated) to collect (defaults are: create exec mmap)")
          print("    usage: --es-logs exec open rename")
          print("--logs -> specify an external text file with unified log predicates to parse")
          print("    usage: --logs /Users/<USER>/Desktop/myPredicates.txt")
-         print("--disable-browser-killswitch -> by default, browsers are force-closed during collection. This will disable the force-closing of browsers.")
-         print("--disable-es-logs -> by default, es logs of create, exec, and mmap are collected. This will disable this default behavior")
          print("--pretty -> colorize Terminal output")
          print("--cleanup -> remove Aftermath Folders in default locations")
          exit(1)

analysis/LogParser.swift

@@ -56,15 +56,10 @@ class LogParser: AftermathModule {
                 self.addTextToFile(atUrl: self.storylineFile, text: text)
             }
         } catch {
-            print("Unable to parse contents")
+            self.log("Unable to parse install log contents")
         }
     }
-
-    fileprivate func sanatizeInfo(_ info: inout String) {
-        info = info.replacingOccurrences(of: ",", with: "")
-        info = info.replacingOccurrences(of: "\"", with: "")
-    }
-
+
     func parseSysLog() {
         // system.log
 
@@ -114,7 +109,7 @@ class LogParser: AftermathModule {
                 self.addTextToFile(atUrl: storylineFile, text: text)
             }
         } catch {
-            print("Unable to parse contents")
+            self.log("Unable to parse syslog contents")
         }
     }
 
@@ -154,10 +149,15 @@ class LogParser: AftermathModule {
                 self.addTextToFile(atUrl: self.storylineFile, text: text)
             }
         } catch {
-            print("Unable to parse contents")
+            self.log("Unable to parse XPR contents")
         }
     }
 
+    fileprivate func sanatizeInfo(_ info: inout String) {
+        info = info.replacingOccurrences(of: ",", with: "")
+        info = info.replacingOccurrences(of: "\"", with: "")
+    }
+
     func run() {
         self.log("Parsing install log...")
         parseInstallLog()

analysis/ProcessParser.swift

@@ -20,40 +20,45 @@ class ProcessParser: AftermathModule {
     func parseProcessDump() {
 
         let procPathRaw = "\(self.collectionDir)/Processes/process_dump.txt"
-        do {
-
-            let data = try String(contentsOf: URL(fileURLWithPath: procPathRaw), encoding: .utf8)
-            let line = data.components(separatedBy: "\n")
-
-            for ind in 1...line.count - 1 {
-                let splitLine = line[ind].components(separatedBy: " ")
+        if filemanager.fileExists(atPath: procPathRaw) {
+            do {
 
-                guard let date = splitLine[safe: 0] else { continue }
-                guard let time = splitLine[safe: 1] else { continue }
-                guard let zone = splitLine[safe: 2] else { continue }
-                let unformattedDate = date + "T" + time + zone // 2022-09-02T17:16:58 +0000
-                let dateFormatter = DateFormatter()
-                dateFormatter.locale = Locale(identifier: "en_US")
-                dateFormatter.dateFormat = "yyyy-MM-dd'T'HH:mm:ssZ" // 2022-09-02T17:16:58+0000
-                dateFormatter.timeZone = TimeZone(secondsFromGMT: 0)
+                let data = try String(contentsOf: URL(fileURLWithPath: procPathRaw), encoding: .utf8)
+                let line = data.components(separatedBy: "\n")
 
-                var info = ""
-                for i in 3...splitLine.count - 1 {
-                    info = info.appending(" " + splitLine[i])
+                for ind in 1...line.count - 1 {
+                    let splitLine = line[ind].components(separatedBy: " ")
+
+                    guard let date = splitLine[safe: 0] else { continue }
+                    guard let time = splitLine[safe: 1] else { continue }
+                    guard let zone = splitLine[safe: 2] else { continue }
+                    let unformattedDate = date + "T" + time + zone // 2022-09-02T17:16:58 +0000
+                    let dateFormatter = DateFormatter()
+                    dateFormatter.locale = Locale(identifier: "en_US")
+                    dateFormatter.dateFormat = "yyyy-MM-dd'T'HH:mm:ssZ" // 2022-09-02T17:16:58+0000
+                    dateFormatter.timeZone = TimeZone(secondsFromGMT: 0)
+
+                    var info = ""
+                    for i in 3...splitLine.count - 1 {
+                        info = info.appending(" " + splitLine[i])
+                    }
+
+                    sanatizeInfo(&info)
+
+                    guard let dateZone = dateFormatter.date(from: unformattedDate) else { continue }
+                    dateFormatter.dateFormat = "yyyy-MM-dd'T'HH:mm:ss'Z'"
+                    let formattedDate = dateFormatter.string(from: dateZone)
+                    let text = "\(formattedDate), PROCESS, \(info)"
+                    self.addTextToFile(atUrl: self.storylineFile, text: text)
                 }
-
-                sanatizeInfo(&info)
-
-                guard let dateZone = dateFormatter.date(from: unformattedDate) else { continue }
-                dateFormatter.dateFormat = "yyyy-MM-dd'T'HH:mm:ss'Z'"
-                let formattedDate = dateFormatter.string(from: dateZone)
-                let text = "\(formattedDate), PROCESS, \(info)"
-                self.addTextToFile(atUrl: self.storylineFile, text: text)
+            } catch {
+                print("Error parsing process dump raw file: \(error)")
             }
-        } catch {
-            print("Error parsing process dump raw file: \(error)")
+        } else {
+            self.log("Process data not available")
         }
     }
+
 
     fileprivate func sanatizeInfo(_ info: inout String) {
         info = info.replacingOccurrences(of: ",", with: "")

analysis/Storyline.swift

@@ -171,6 +171,31 @@ class Storyline: AftermathModule {
         }
     }
 
+    func addBraveData() {
+        let bravePaths = ["history":"\(collectionDir)/Browser/Brave/history_output.csv","downloads":"\(collectionDir)/Browser/Brave/downloads_output.csv"]
+
+        for (title,p) in bravePaths {
+
+            if !filemanager.fileExists(atPath: p) { continue }
+
+            var data = ""
+
+            do {
+                data = try String(contentsOfFile: p)
+            } catch {
+                print(error)
+            }
+
+            var rows = data.components(separatedBy: "\n")
+            rows.removeFirst()
+            for row in rows {
+                if row == "" { continue }
+                let columns = row.components(separatedBy: ",")
+                self.addTextToFile(atUrl: self.storylineFile, text: "\(columns[0]),brave_\(title),\(columns[3]))")
+            }
+        }
+    }
+
     func sortStoryline() {
 
         self.log("Creating the storyline...Please wait...")
@@ -248,6 +273,7 @@ class Storyline: AftermathModule {
         addChromeData()
         addEdgeData()
         addArcData()
+        addBraveData()
         sortStoryline()
         removeUnsorted()
     }