Keychain credential dump
The macOS security command used to read secrets out of a keychain — either dumping a whole keychain (dump-keychain -d) or extracting a specific…
What it detects
The macOS security command used to read secrets out of a keychain — either dumping a whole keychain (dump-keychain -d) or extracting a specific password in cleartext (find-generic-password -w, find-internet-password -w).
The keychain is where macOS puts saved passwords, browser credentials, wifi keys, certificates and their private keys. -d and -w are the flags that ask for the DECRYPTED value; without them the same subcommands print only metadata, which is why the rule keys on the flags rather than on the subcommand alone.
Written against real attacker command lines from sbousseaden/macOS-ATTACK-DATASET (security dump-keychain -d, security find-generic-password -wa Chrome) after a measurement showed the pack had NO macOS credential-access rule at all — nine macOS rules, none of them covering the platform's central credential store.
MITRE ATT&CK mapping
False positives and triage
A user unlocking their own keychain through the GUI does not run this; the command line is the signal. Legitimate uses exist and are narrow: a developer scripting against their own login keychain, or an MDM/backup tool with a documented need.
Escalate on: dump-keychain at all (it asks for EVERY secret, and a prompt-storm is what an operator would notice), a target keychain under /Library/Keychains/System.keychain rather than the user's login keychain, the output being redirected to a file, or the command running under a shell whose parent is not a terminal.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 80%. Source: rules/macos/keychain_credential_dump.yaml, licensed under the Apache License 2.0.
id: macos.credential_access.keychain_credential_dump
version: 1.0.0
status: stable
severity: high
confidence: 0.8
platforms: [macos]
mitre_techniques: [T1555.001, T1555]
description: |
The macOS `security` command used to read secrets out of a keychain — either
dumping a whole keychain (`dump-keychain -d`) or extracting a specific
password in cleartext (`find-generic-password -w`, `find-internet-password -w`).
The keychain is where macOS puts saved passwords, browser credentials, wifi
keys, certificates and their private keys. `-d` and `-w` are the flags that ask
for the DECRYPTED value; without them the same subcommands print only metadata,
which is why the rule keys on the flags rather than on the subcommand alone.
Written against real attacker command lines from sbousseaden/macOS-ATTACK-DATASET
(`security dump-keychain -d`, `security find-generic-password -wa Chrome`) after
a measurement showed the pack had NO macOS credential-access rule at all — nine
macOS rules, none of them covering the platform's central credential store.
match:
raw_message_regex: '(?i)\bsecurity\b\s+(-\S+\s+)*(dump-keychain\b[^|;]*\s-\S*d|(find-generic-password|find-internet-password)\b[^|;]*\s-\S*w)'
false_positive_guidance: |
A user unlocking their own keychain through the GUI does not run this; the
command line is the signal. Legitimate uses exist and are narrow: a developer
scripting against their own login keychain, or an MDM/backup tool with a
documented need.
Escalate on: `dump-keychain` at all (it asks for EVERY secret, and a prompt-storm
is what an operator would notice), a target keychain under
`/Library/Keychains/System.keychain` rather than the user's login keychain, the
output being redirected to a file, or the command running under a shell whose
parent is not a terminal.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.