MacOS-Analyzer-Suite

A collection of PowerShell scripts for analyzing macOS Forensic Artifacts

The following MacOS Forensic Artifacts are supported yet:

• FSEvent Logs → FSEvents-Analyzer
• LSQuarantine database file(s) → Quarantine-Analyzer
• TCC database file(s) → TCC-Analyzer
• XProtect Behavioral Service database file(s) → XProtect-Analyzer

Note

MacOS-Analyzer-Suite includes all external tools by default.

Prerequisites

1. Windows PowerShell 5.1 or newer.

Setup

1. Download the latest version of the MacOS-Analyzer-Suite from the Releases section.

2. Install ImportExcel PowerShell module to import/export Excel spreadsheets, without Excel.

   Install-Module -Name ImportExcel

3. Install Python 3 and add it to your PATH environment variable.

4. Run the specific script in PowerShell (e.g. TCC-Analyzer.ps1).

5. Optional: Edit Config.json to choose your own Excel color scheme.

Usage

Open PowerShell and navigate to the directory containing e.g. TCC-Analyzer.ps1 and run the script with following command: .\TCC-Analyzer.ps1

Fig 1: Select your TCC Database file

You can skip the file selection dialog and provide the file path to your log file with following command:
.\TCC-Analyzer.ps1 -Path "$env:USERPROFILE\Desktop\tcc_<USERNAME>"

You can specify the output directory with following command:
.\TCC-Analyzer.ps1 -Path "H:\macos-collector\tcc_<USERNAME>" -OutputDir "H:\MacOS-Analyzer-Suite"

Note

Default output directory is $env:USERPROFILE\Desktop\TCC-Analyzer
The subdirectory 'TCC-Analyzer' is automatically created.

Fig 1: FSEvents-Analyzer

Fig 2: MessageBox

Fig 3: Quarantine-Analyzer

Fig 4: TCC-Analyzer

Fig 5: XProtect-Analyzer

Fig 6: XProtect Behavior Service

Fig 7: Bastion-Rules.xlsx (Stats)

License

This project is licensed under the MIT License - see the LICENSE file for details.

Links

Aftermath by Jamf Threat Labs
macos-collector by LETHAL-FORENSICS