MITRE ATT&CK technique · Credential Access

`T1555.001` Keychain

Sub-technique of T1555 Credentials from Password Stores

Adversaries may acquire credentials from Keychain. Keychain (or Keychain Services) is the macOS credential management system that stores account names, passwords, private keys, certificates, sensitive application data, payment data, and secure notes. There are three types of Keychains: Login Keychain, System Keychain, and Local Items (iCloud) Keychain. The default Keychain is the Login Keychain,…

MITRE ATT&CK page ↗

Who uses it · with stories on Jábega

GlassWorm

Sigma rules to hunt it

Credentials from Password Stores - Keychainmediumtest · macos

Rules from SigmaHQ · Detection Rule License 1.1. Technique from MITRE ATT&CK®.