In the Aftermath

Matt Benyo, of Jamf's macOS threat research team, starts with a familiar gap in incident response: by the time outside help arrives, days or weeks may have passed and the endpoint evidence is stale. Many smaller organizations hand alerts to admins who lack the expertise to interpret them, which leaves support staff caught between vendor and customer.

To close that gap, the team built Aftermath, a lightweight, open-source incident response framework written in Swift so it runs natively on macOS without requiring Python. It collects roughly a dozen categories of artifacts, including persistence items, running processes, unified logs, browser history and downloads, a copy of the TCC permissions database, and a system overview. The demo followed a pirated video editing app that carried a cryptocurrency miner. Aftermath was triggered by an MDM-driven detection workflow, and its analysis mode parsed the TCC data and normalized mixed timestamp formats into a single timeline. That timeline exposed the download chain and an unfamiliar anonymous-network daemon.

The talk closes with planned version two work: uploading collected output to cloud storage, gathering extended attributes, and pivoting from property list files to the binaries they reference. The practical takeaway is that collection should be automated and fast, and that normalized timelines help less experienced responders reach a useful story about how malware got onto a host.