Interact with Keychain, macOS's built-in password manager.
securitysecuritySandbox: execFile · Timeout: 30s
credential.dump security.defenseevasion.bypass Dump credentials, keys, certificates, and other sensitive information from Keychain: This command will dump keychain passwords from login.keychain
sudo security dump-keychain -d login.keychainRetrieve Chrome's "Chrome Safe Storage" password manager secret: This command will retrieve the Chrome Safe Storage password manager secret from the keychain.
security find-generic-password -w -s "Chrome Safe Storage"Add an arbitrary trusted certificate to aid a MITM attack: This command will add a certificate to the keychain.
security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain bad_cert.crt| Type | Rule / Indicator |
|---|---|
| sigma | https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_creds_from_keychain.yml Sigma: Credentials from Password Stores - Keychain |
| elastic | https://github.com/elastic/detection-rules/blob/main/rules/macos/credential_access_credentials_keychains.toml Elastic: Access to Keychain Credentials Directories |
| elastic | https://github.com/elastic/detection-rules/blob/main/rules/macos/credential_access_dumping_keychain_security.toml Elastic: Credential Access Dumping Keychain Security |
| elastic | https://github.com/elastic/detection-rules/blob/main/rules/macos/credential_access_keychain_pwd_retrieval_security_cmd.toml Elastic: Keychain Password Retrieval via Command Line |
| other | https://github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/keychain_dumped Jamf Protect: Detect Keychain dumping using security |
security is a command-line utility included in macOS that allows users to interact with the Keychain app. Keychains allow users to manager passwords and credentials for many services and features, including Wi-Fi and website passwords, secure notes, certificates, and Kerberos.