multiple updates - Githubissues

jamf / aftermath

Aftermath is a free macOS IR framework

MIT License

460 stars 33 forks source link

multiple updates #21

Closed stuartjash closed 2 years ago

stuartjash commented 2 years ago

initialized a readme
added zip and unzip functionality to aftermath directories
birth metadata
moved tcc and lsquarantine parsing to analysis modules
removed aftermath directories from common directory scanning
removed memory modules (bump to v2)
read rows of a csv
lsof output to network module
cron jobs and at tabs
added capturing emond
capturing login items (btm file)
grabbing /etc/passwd file
dump processes (timestamp, pid, ppid, submitted pid, responsible pid, path, args)

c7bercat commented 2 years ago

I've gone through 13/32 files, I'll look through more in the coming days (:

And of course if the code works it works... not strictly necessary to change what works, especially if you're in a hurry. If you prefer to not use my changes that is truly just fine!