Elastic Defend high stable eql

User Keychain DB Access by Self-Signed Binary

Detects when a self-signed binary (signed with native CodeSign tool) attempts to open the user's Keychain DB. This activity is not normal and should be considered suspicious. The macOS keychain is highly sought after and targeted by threat actors as it contains sensitive credential data that can be used to further compromise a user or environment.

View Source

Detection Logic

file where event.action == "open" and file.name like "login.keychain-db" and 
 process.code_signature.trusted == false and 
 process.code_signature.signing_id regex~ """[A-Za-z0-9\_\s]{2,}\-[a-z0-9]{40}""" and 
 not process.executable like ("/opt/homebrew/*", "/usr/local/Cellar/*") and 
 not process.code_signature.signing_id like~ ("python-*", 
                                              "python3-*", 
                                              "apphost-*", 
                                              "laclient-*",
                                              "emulator-*",
                                              "eclipse-*",
                                              "mksdcard-*",
                                              "MicrosoftSqlToolsServiceLayer-*",
                                              "binary-*", 
                                              "ruby-*",
                                              "rg-*", 
                                              "jspawnhelper-*",
                                              "dotnet-*") and 
not Effective_process.executable like ("/Users/*/Library/Application Support/Claude/claude-code/*/claude.app/Contents/MacOS/claude", "/Applications/Claude.app/Contents/MacOS/Claude") and 
not process.executable == "/usr/local/bin/symfony"

Field Validations

Loading…

Comments (0)

Loading comments...