MacOS IR Tools

Description

Need to perform an incident or investigation on a MacOS Box but don't know how or where to begin? Maybe your searching for a tool that can poll information from an affected or breached system in a relative short amount of time with repeatable and reliable results. MacOSIR has many of the configured items IR professionals utilize and, with life-time updates tools will be added to help you do a better job each and every time. Information that MacOSIR obtains are as follows:

File System Information
- Downloads, Desktop, Videos, Photo hash fingerprints
- Files / Folders created in the last 30 days.
- Files with improper permissions (web root, etc.)
- Users in user path
Network Information
- IP Address information
- Public IP Address
- Network routes
- Hosts file, ssh file
- list of connected WiFi Networks, Preferred WiFi Networks and currently connected network
- WiFi Networks within range of incident
- Connected, Foreign IP addresses, PIDs and Ports
- Remote users logged in
- Host file
- ssh and other network files

Software Information
- Running applications
- Running services
- KEXT Modules, hashes, and who created the modules.
- Installed applications
- process owners / location of running application
Disk Information
- Physical hard disks
- Virtual Hard Disks
- USB Hard disk / devices plugged in
- File hashing of files on both DMG and external disks connected.
- Disk information
USB Information
- Connected USB devices and classes
- Identification of devices (HID devices, rubber ducky, etc.)

Bluetooth Information
- Connected bluetooth devices - Bluetooth devices previously seen - Bluetooth devices first time seen - Devices currently within range.

Diagnostic Information
- Gathers apple diagnostic information
- Gathers system logs



And much much more...