KeydnapS0276 ↗
Uses the keychaindump project to read securityd memory.1
tfMITRE ATT&CK sub-technique
Securityd Memory T1555.002
sub-technique of T1555 Credentials from Password Stores
- Tactic
- Credential Access
- Platforms
- Linux, macOS
- Version
- 1.2
- Created
- 12 February 2020
- Last modified
- 24 October 2025
An adversary with root access may gather credentials by reading securityd’s memory. securityd is a service/daemon responsible for implementing security protocols such as encryption and authorization.[1] A privileged adversary may be able to scan through securityd's memory to find the correct sequence of keys to decrypt the user’s logon keychain. This may provide the adversary with various plaintext passwords, such as those for users, WiFi, mail, browsers, certificates, secure notes, etc.[2][3]
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
0
Threat groupsNone recorded
Threat groupsNone recorded · 29% of ATT&CK techniques have none either.0
CampaignsNone recorded
CampaignsNone recorded · 54% of ATT&CK techniques have none either.1
Tools & malware44th pct
Tools & malware44th percentile · 56% of ATT&CK techniques have more tools implementing them.0
Detection rulesNone recorded
Detection rulesNone recorded · 33% of ATT&CK techniques have none either.Securityd Memory MITRE reference T1555.002
44th pctamong all ATT&CK techniques for number of tools
1 software entry is documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
All 1 software entries for this technique
Offense vs defense T1555.002
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
Securityd Memory detection strategy DET0057
MITRE names one behaviour worth catching for this technique and breaks it into 2 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detect Suspicious Access to securityd Memory for Credential Extraction
2 platforms
AN0156 · macOS
Detects suspicious memory access attempts targeting the securityd process. Observes tools invoking process memory read operations (e.g., ptrace, task_for_pid) against securityd. Correlates with anomalous parent process lineage, root privilege escalation, or repeated unauthorized attempts.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | macos:unifiedlog | execution of memory inspection tools (lldb, gdb, osqueryi) |
| Process AccessDC0035 | macos:unifiedlog | ptrace or task_for_pid |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| AllowedDebuggers | List of authorized debugging tools permitted in dev/test environments |
| TimeWindow | Correlation period between memory inspection and Keychain API access |
| PrivilegedUsers | Expected set of admin accounts with legitimate debugging permissions |
AN0157 · Linux
Detects adversaries attempting to attach debuggers or memory dump utilities to credential storage daemons analogous to macOS securityd. Observes ptrace syscalls, /proc/<pid>/mem access, or gcore dumps against sensitive processes. Correlates anomalies with privilege escalation or credential dumping attempts.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process AccessDC0035 | auditd:SYSCALL | ptrace attach |
| File AccessDC0055 | auditd:FILE | /proc/*/mem read attempt |
| Command ExecutionDC0064 | auditd:EXECVE | gcore, gdb, strings, hexdump execution |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| MonitoredProcesses | List of credential storage daemons (e.g., securityd, gnome-keyring, kwallet) monitored for memory access attempts |
| CorrelationDepth | Defines how many chained events (process execution + syscall + file read) to correlate before raising an alert |
| PrivilegeContext | Expected user/group context for processes allowed to access protected memory |