tfMITRE ATT&CK sub-technique

Keychain T1555.001

sub-technique of T1555 Credentials from Password Stores

Tactic: Credential Access
Platform: macOS
Version: 1.1
Created: 12 February 2020
Last modified: 12 May 2026

Adversaries may acquire credentials from Keychain. Keychain (or Keychain Services) is the macOS credential management system that stores account names, passwords, private keys, certificates, sensitive application data, payment data, and secure notes. There are three types of Keychains: Login Keychain, System Keychain, and Local Items (iCloud) Keychain. The default Keychain is the Login Keychain, which stores user passwords and information. The System Keychain stores items accessed by the operating system, such as items shared among users on a host. The Local Items (iCloud) Keychain is used for items synced with Apple’s iCloud service.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups45th pct

Threat groups45th percentile · 55% of ATT&CK techniques have more threat groups attributed.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malwareTop 24%

Tools & malware76th percentile · 76% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rules50th pct

Detection rules50th percentile · 50% of ATT&CK techniques have more detection rules written.

Keychain MITRE reference T1555.001

45th pctamong all ATT&CK techniques for number of groups

1 group has been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

Contagious InterviewG1052 ↗

Has leveraged malware variants configured to dump credentials from the macOS keychain.1 2 3

created 2025-10-193 referencesaka DeceptiveDevelopment

All 1 groups for this technique

11 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.

GlassWormS9010 ↗

Has collected keys stored within /Library/Keychains/login.keychain-db.1 2

created 2026-04-10MALWARE

BeaverTailS1246 ↗

Has collected keys associated with macOS within /Library/Keychains/login.keychain.1 2 3

created 2025-10-19MALWAREcarried by 1 group

LightSpyS1185 ↗

Performs an in-memory keychain query via SecItemCopyMatching() then formats the retrieved data as a JSON blob for exfiltration.1

created 2025-01-03MALWAREcarried by 1 group

Cuckoo StealerS1153 ↗

Can capture files from a targeted user's keychain directory.1

created 2024-08-20MALWARE

MacMaS1016 ↗

Can dump credentials from the macOS keychain.1

created 2022-05-06MALWAREcarried by 1 group

Green LambertS0690 ↗

Can use Keychain Services API functions to find and collect passwords, such as SecKeychainFindInternetPassword and SecKeychainItemCopyAttributesAndData.1 2

created 2022-03-21MALWARE

All 11 software entries for this technique · 6 newest in this preview

Offense vs defense T1555.001

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 0Sigma rules (cumulative) · 1Splunk ESCU (cumulative) · 1

first rule: 2020 Q4

Keychain detection strategy DET0396

MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detect Access to macOS Keychain for Credential Theft

Enterprise

1 platform

AN1112 · macOS

Detects suspicious access to macOS Keychain files and APIs. Observes processes invoking the 'security' utility or accessing Keychain databases directly, correlates these with abnormal parent process lineage or unexpected user context. Monitors attempts to dump, unlock, or read credential storage beyond normal application workflows.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
OS API ExecutionDC0021	macos:unifiedlog	access or unlock attempt to keychain database
Process CreationDC0032	macos:unifiedlog	execution of security or osascript
File AccessDC0055	macos:unifiedlog	read access to ~/Library/Keychains/login.keychain-db

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
AllowedApplications	Whitelist of applications (e.g., Safari, Mail) normally permitted to access Keychain
AlertThreshold	Number of failed keychain unlock attempts before raising an alert
ParentProcessContext	Legitimate parent-child process relationships for security tool invocations

Tests4Executorssh 4Need elevation1 of 4Have prerequisites0Have cleanup2Platformsmacos

Test

Platform

Executor

Elevation

Prereqs

Cleanup

Ref

Keychain Dump

macos

Required

—

Export Certificate Item(s)

macos

—

Yes

This command finds all certificate items and sends the output to local file in pem format.

Input arguments

Name	Type	Default	Description
cert_export	path	/tmp/certs.pem	Specify the path of the certificates to export.

Attack command

security find-certificate -a -p > #{cert_export}

Cleanup command

rm #{cert_export}

GUID801dba40-7829-4514-8da6-b59bd8aec73e

Import Certificate Item(s) into Keychain

macos

—

This command will import a certificate pem file into a keychain.

Input arguments

Name	Type	Default	Description
cert_export	path	/tmp/certs.pem	Specify the path of the pem certificate file to import.

Attack command

security import #{cert_export} -k

GUIDd196ea19-4697-455d-b75a-88570ef63107

Copy Keychain using cat utility

macos

—

Yes

This command will copy the keychain using the cat utility in a manner similar to Atomic Stealer.

Input arguments

Name	Type	Default	Description
keychain_export	path	/tmp/keychain	Specify the path to copy they keychain into.

Attack command

cat ~/Library/Keychains/login.keychain-db > #{keychain_export}

Cleanup command

rm #{keychain_export}

GUID9054bf84-a62b-4c0b-bd6d-be9902222dce

Tests from Atomic Red Team (MIT licence) · technique definition

Keychain detections T1555.001

2 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

50th pctamong all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs