THREATNOIR
Subscribe
MITRE ATT&CK · T1555.001

Keychain

MITRE · cited in 6 of our lessons

Explanation

What attackers do. Attackers access the macOS Keychain, the system store for passwords, certificates and keys, to obtain saved credentials. This serves the Credential Access tactic.

How to defend. Keep macOS updated, use endpoint protection that monitors Keychain access, and restrict admin rights. Use mobile device management to enforce security settings, and prefer an enterprise password manager for corporate credentials. Lock screens promptly and require the user password for Keychain access, which makes silent extraction harder. Collect macOS unified logs and endpoint telemetry centrally so access attempts can be reviewed alongside other activity.

Signs to look for. Look for command-line tools or unknown processes querying the Keychain, copies of Keychain files and repeated password prompts that users did not expect. A common gap is weaker endpoint monitoring on macOS compared with Windows.

Open the technique on MITRE ATT&CK
The official text
Adversaries may acquire credentials from Keychain. Keychain (or Keychain Services) is the macOS credential management system that stores account names, passwords, private keys, certificates, sensitive application data, payment data, and secure notes. There are three types of Keychains: Login Keychain, System Keychain, and Local Items (iCloud) Keychain. The default Keychain is the Login Keychain, which stores user passwords and information. The System Keychain stores items accessed by the operating system, such as items shared among users on a host. The Local Items (iCloud) Keychain is used for items synced with Apple’s iCloud service. Keychains can be viewed and edited through the Keychain Access application or using the command-line utility `security`. Keychain files are located in `~/Library/Keychains/`, `/Library/Keychains/`, and `/Network/Library/Keychains/`. Adversaries may gather user credentials from Keychain storage/memory. For example, the command `security dump-keychain –d` will dump all Login Keychain credentials from `~/Library/Keychains/login.keychain-db`. Adversaries may also directly read Login Keychain credentials from the `~/Library/Keychains/login.keychain` file. Both methods require a password, where the default password for the Login Keychain is the current user’s password to login to the macOS host.

© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation (MITRE ATT&CK®).

Lessons that cite it

Real incidents where this item mattered.