security

This command will dump keychain passwords from login.keychain

sudo security dump-keychain -d login.keychain

Evidence

Upstream reference

Environment

Local host

Compatibility

Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.

Native

Credential Access

Detection

Sigma: Credentials from Password Stores - Keychain: github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_creds_from_keychain.yml

Elastic: Access to Keychain Credentials Directories: github.com/elastic/detection-rules/blob/main/rules/macos/credential_access_credentials_keychains.toml

Elastic: Credential Access Dumping Keychain Security: github.com/elastic/detection-rules/blob/main/rules/macos/credential_access_dumping_keychain_security.toml

Elastic: Keychain Password Retrieval via Command Line: github.com/elastic/detection-rules/blob/main/rules/macos/credential_access_keychain_pwd_retrieval_security_cmd.toml

Jamf Protect: Detect Keychain dumping using security: github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/keychain_dumped

Refs

github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/security.yml

www.netmeister.org/blog/keychain-passwords.html

ss64.com/osx/security.html

This command will retrieve the Chrome Safe Storage password manager secret from the keychain.

security find-generic-password -w -s "Chrome Safe Storage"

Evidence

Upstream reference

Environment

Local host

Compatibility

Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.

Native

Credential Access

Detection

Sigma: Credentials from Password Stores - Keychain: github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_creds_from_keychain.yml

Elastic: Access to Keychain Credentials Directories: github.com/elastic/detection-rules/blob/main/rules/macos/credential_access_credentials_keychains.toml

Elastic: Credential Access Dumping Keychain Security: github.com/elastic/detection-rules/blob/main/rules/macos/credential_access_dumping_keychain_security.toml

Elastic: Keychain Password Retrieval via Command Line: github.com/elastic/detection-rules/blob/main/rules/macos/credential_access_keychain_pwd_retrieval_security_cmd.toml

Jamf Protect: Detect Keychain dumping using security: github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/keychain_dumped

Refs

github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/security.yml

www.netmeister.org/blog/keychain-passwords.html

ss64.com/osx/security.html

This command will add a certificate to the keychain.

security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain bad_cert.crt

Evidence

Upstream reference

Environment

Local host

Compatibility

Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.

Native

Defense Evasion

Detection

Sigma: Credentials from Password Stores - Keychain: github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_creds_from_keychain.yml

Elastic: Access to Keychain Credentials Directories: github.com/elastic/detection-rules/blob/main/rules/macos/credential_access_credentials_keychains.toml

Elastic: Credential Access Dumping Keychain Security: github.com/elastic/detection-rules/blob/main/rules/macos/credential_access_dumping_keychain_security.toml

Elastic: Keychain Password Retrieval via Command Line: github.com/elastic/detection-rules/blob/main/rules/macos/credential_access_keychain_pwd_retrieval_security_cmd.toml

Jamf Protect: Detect Keychain dumping using security: github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/keychain_dumped

Refs

github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/security.yml

www.netmeister.org/blog/keychain-passwords.html

ss64.com/osx/security.html