Credentials from Password Stores: Keychain `T1555.001`

Tactic: Credential Access

Adversaries may acquire credentials from Keychain. Keychain (or Keychain Services) is the macOS credential management system that stores account names, passwords, private keys, certificates, sensitive application data, payment data, and secure notes. There are three types of Keychains: Login Keychain, System Keychain, and Local Items (iCloud) Keychain. The default Keychain is the Login Keychain, which stores user passwords and information. The System Keychain stores items accessed by the operating system, such as items shared among users on a host. The Local Items (iCloud) Keychain is used for items synced with Apple’s iCloud service.

Events covered

4 catalog events are tagged with this technique by at least one rule.

Provider	Event	Title
ESF	exec	Process Execution
ESF	open	File Open
ESF	rename	File Rename
ESF	write	File Write

Authoring guide

These 20 rules share fields, values, and exclusions.

Fields filtered most (22 distinct)

These fields appear most often in rule filters.

Field	Rules	How	Sample values
`EventType`	15	`eq` 14, `in` 1	`exec`, `open`, `modification`, `rename`
`process_name`	12	`eq` 7, `in` 4, `starts_with` 1	`cp`, `cat`, `security`, `bash`, `curl`
`CommandLine`	9	`contains` 6, `wildcard` 3	`/Users//Library/Keychains/login.keychain-db`, `dump-keychain` , `export` , `login-keychain` , `/Library/Keychains/*`
`event.type`	8	`eq` 5, `in` 3	`start`, `process_started`
`file.name`	5	`eq` 5	`login.keychain-db`
`host.os.type`	5	`eq` 5
`process.args`	5	`eq` 3, `in` 1, `wildcard` 1	`-d`, `dump-keychain`, `-ga`, `-wa`, `/Library/Keychains/*`
`Image`	3	`eq` 2, `wildcard` 1	`/usr/bin/security`, `/private/var/folders/.app/`, `/volumes/*`
`parent_process_name`	2	`in` 2	`bash`, `node`, `osascript`, `sh`, `terminal`
`process.code_signature.exists`	2	`eq` 2	`false`
`process.code_signature.trusted`	2	`eq` 2	`false`
`DestinationHostname`	1	`is_null` 1
`ParentImage`	1	`wildcard` 1	`/library/caches/`, `/private/tmp/`, `/private/var/folders/*`
`TargetFilename`	1	`wildcard` 1	`/users/*/library/keychains/login.keychain-db`
`event.category`	1	`eq` 1	`file`

Top indicator values (106 distinct)

These values appear most often in rule predicates.

Field	Kind	Value	Rules (here)	Corpus reach
`EventType`	`eq`	`exec` elasticKeychain CommandLine Interaction via Unsigned or Untrusted Process elasticKeychain Credential Files Collected via Archive Utility elasticKeychain Dump via Native Security Tool elasticKeychain Password Retrieval via Command Line elasticSystemKey Access via Command Line elasticUser Keychain copied via Script Interpreter elasticUser Keychain copied via Shell interpreter elasticUser Keychain Copied via Suspicious Parent elasticUser Keychain Exfiltration via Curl	9	579
`EventType`	`eq`	`open` elasticFirst Time Python Accessed Sensitive Credential Files elasticSuspicious User Keychain Access via Nodejs elasticSuspicious User Keychain DB Access by Unsigned Binary elasticUser Keychain DB Access by Osascript elasticUser Keychain DB Access by Self-Signed Binary	5	52
`event.type`	`eq`	`start` elasticSuspicious User Keychain Access via Nodejs elasticUser Keychain copied via Script Interpreter elasticUser Keychain copied via Shell interpreter elasticUser Keychain Copied via Suspicious Parent elasticUser Keychain Exfiltration via Curl	5	1087
`file.name`	`eq`	`login.keychain-db` elasticSuspicious User Keychain Access via Nodejs elasticSuspicious User Keychain DB Access by Unsigned Binary elasticUser Keychain Access in Unusual Location elasticUser Keychain DB Access by Osascript elasticUser Keychain DB Access by Self-Signed Binary	5	6
`event.type`	`in`	`process_started` elasticDumping of Keychain Content via Security Command elasticKeychain CommandLine Interaction via Unsigned or Untrusted Process elasticSystemKey Access via Command Line	3	39
`event.type`	`in`	`start` elasticDumping of Keychain Content via Security Command elasticKeychain CommandLine Interaction via Unsigned or Untrusted Process elasticSystemKey Access via Command Line	3	41
`process_name`	`eq`	`cp` elasticUser Keychain copied via Script Interpreter elasticUser Keychain copied via Shell interpreter elasticUser Keychain Copied via Suspicious Parent	3	9
`process_name`	`eq`	`security` elasticKeychain Dump via Native Security Tool elasticKeychain Password Retrieval via Command Line	2	4
`CommandLine`	`contains`	`find-certificate` sigmaCredentials from Password Stores - Keychain splunkMacOS Keychains Dumped	2	2
`CommandLine`	`contains`	`dump-keychain` sigmaCredentials from Password Stores - Keychain	1
`CommandLine`	`contains`	`export` sigmaCredentials from Password Stores - Keychain	1	3
`CommandLine`	`contains`	`login-keychain` sigmaCredentials from Password Stores - Keychain	1
`CommandLine`	`contains`	`-d` splunkMacOS Keychains Dumped	1	8
`CommandLine`	`contains`	`-p` splunkMacOS Keychains Dumped	1
`CommandLine`	`contains`	`.keychain` splunkMacOS Keychains Dumped	1
`CommandLine`	`contains`	`/private/var/db/systemkey` elasticSystemKey Access via Command Line	1
`CommandLine`	`contains`	`brave` elasticKeychain Password Retrieval via Command Line	1	4
`CommandLine`	`contains`	`chrome` elasticKeychain Password Retrieval via Command Line	1	4
`CommandLine`	`contains`	`chromium` elasticKeychain Password Retrieval via Command Line	1	4
`CommandLine`	`contains`	`dump-keychain` splunkMacOS Keychains Dumped	1
`CommandLine`	`contains`	`firefox` elasticKeychain Password Retrieval via Command Line	1	2
`CommandLine`	`contains`	`keychain` elasticUser Keychain copied via Script Interpreter	1
`CommandLine`	`wildcard`	`/Users//Library/Keychains/login.keychain-db*` elasticUser Keychain copied via Shell interpreter elasticUser Keychain Exfiltration via Curl	2	2
`Image`	`eq`	`/usr/bin/security` sigmaCredentials from Password Stores - Keychain splunkMacOS Keychains Dumped	2	2
`process.args`	`eq`	`-d` elasticDumping of Keychain Content via Security Command elasticKeychain Dump via Native Security Tool	2	12
`process.args`	`eq`	`dump-keychain` elasticDumping of Keychain Content via Security Command elasticKeychain Dump via Native Security Tool	2	2
`process.code_signature.exists`	`eq`	`false` elasticKeychain CommandLine Interaction via Unsigned or Untrusted Process elasticSuspicious User Keychain DB Access by Unsigned Binary	2	119
`process.code_signature.trusted`	`eq`	`false` elasticKeychain CommandLine Interaction via Unsigned or Untrusted Process elasticUser Keychain DB Access by Self-Signed Binary	2	115
`process_name`	`in`	`cat` elasticKeychain CommandLine Interaction via Unsigned or Untrusted Process splunkMacOS Keychains Dumped	2	28
`process_name`	`in`	`cp` elasticKeychain CommandLine Interaction via Unsigned or Untrusted Process splunkMacOS Keychains Dumped	2	18

Exclusions (73 distinct)

These values appear most often in top-level exclusions.

Field	Kind	Value	Rules excluding
`CommandLine`	`wildcard`	`/Volumes//var/db/SystemKey*` elasticSystemKey Access via Command Line	1
`Effective_process.executable`	`wildcard`	`/Applications/Claude.app/Contents/MacOS/Claude` elasticUser Keychain DB Access by Self-Signed Binary	1
`Effective_process.executable`	`wildcard`	`/Users/*/Library/Application...` elasticUser Keychain DB Access by Self-Signed Binary	1
`Image`	`eq`	`/opt/jc/bin/jumpcloud-agent` elasticKeychain Credential Files Collected via Archive Utility	1
`Image`	`eq`	`/usr/local/bin/symfony` elasticUser Keychain DB Access by Self-Signed Binary	1
`Image`	`starts_with`	`/opt/homebrew/` elasticUser Keychain DB Access by Self-Signed Binary	1
`Image`	`starts_with`	`/usr/local/cellar/` elasticUser Keychain DB Access by Self-Signed Binary	1
`ParentImage`	`eq`	`/applications/microsoft...` elasticKeychain Credential Files Collected via Archive Utility	1
`ParentImage`	`eq`	`/applications/openvpn connect/openvpn connect.app/contents/macos/openvpn connect` elasticKeychain Credential Files Collected via Archive Utility	1
`ParentImage`	`eq`	`/opt/jc/bin/jumpcloud-agent` elasticKeychain Credential Files Collected via Archive Utility	1
`ParentImage`	`wildcard`	`/applications/keeper password manager.app/contents/frameworks/keeper...` elasticKeychain Password Retrieval via Command Line	1
`Signature`	`eq`	`Software Signing` elasticUser Keychain Access in Unusual Location	1
`TargetFilename`	`wildcard`	`/private/var/*` elasticUser Keychain Access in Unusual Location	1
`TargetFilename`	`wildcard`	`/users//library/keychains/` elasticUser Keychain Access in Unusual Location	1
`TargetFilename`	`wildcard`	`/volumes/*` elasticUser Keychain Access in Unusual Location	1

Rules under this technique

These vendors publish rules tagged with this technique.

Platform: macOS

Domain: Endpoint

Sigma 2 rules

Elastic 17 rules

Splunk 1 rule

MacOS Keychains Dumped

Credentials from Password Stores: Keychain T1555.001