macOS: Keychain password dumping via /usr/bin/security command lines

title: "macOS: Keychain password dumping via /usr/bin/security command lines"
id: 1a2a1f67-2f37-4511-8be0-8a791e2a30c5
status: test
description: This rule flags process executions of /usr/bin/security with command-line arguments commonly used to export certificates and dump Keychain items. Attackers may leverage these capabilities to extract credentials from a user’s keychain for offline use or further access. Detection relies on macOS process creation telemetry, specifically matching command-line substrings in the /usr/bin/security invocation.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1555.001/T1555.001.md
  - https://gist.github.com/Capybara/6228955
  - https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_creds_from_keychain.yml
author: Tim Ismilyaev, oscd.community, Florian Roth (Nextron Systems), Huntrule Team
date: 2020-10-19
modified: 2021-11-27
tags:
  - attack.credential-access
  - attack.t1555.001
logsource:
  category: process_creation
  product: macos
detection:
  selection1:
    Image: /usr/bin/security
    CommandLine|contains:
      - find-certificate
      - " export "
  selection2:
    CommandLine|contains:
      - " dump-keychain "
      - " login-keychain "
  condition: 1 of selection*
falsepositives:
  - Legitimate administration activities
level: medium
license: DRL-1.1
related:
  - id: b120b587-a4c2-4b94-875d-99c9807d6955
    type: derived