Anvilogic high experimental spl

Keychain Export - MacOS [splunk-edr]

Adversaries may acquire credentials from Keychain. Keychain (or Keychain Services) is the macOS credential management system that stores account names, passwords, private keys, certificates, sensitive application data, payment data, and secure notes. Keychains can be viewed and edited through the Keychain Access application or using the command-line utility security. This use case detects commands used to access, dump, or export information from keychains. Atomics T1555.001 Test #1

View Source

Detection Logic

`get_endpoint_data` `get_endpoint_data_edr` "security" 
AND ("find-certificate" 
OR "keychain" 
OR "export")
| table _time, host, user, process, process_*
| where match (process, "(?i)(find-certificate)
| ((list
| default
| login
| show
| dump)-keychain)
| (export)") and match(parent_process_name, "(?i)zsh
| bash
| sh
| tcsh
| csh
| ksh") `group_events(host,1)`

Field Validations

Loading…

Comments (0)

Loading comments...