MITRE ATT&CKsub-technique

T1555.001 Keychain

Published 2020-02-12 Modified 2026-05-12 Official page ↗
Domain
enterprise
Tactics
Credential Access
Platforms
macOS
Version
1.1
Created
2020-02-12

Description

Adversaries may acquire credentials from Keychain. Keychain (or Keychain Services) is the macOS credential management system that stores account names, passwords, private keys, certificates, sensitive application data, payment data, and secure notes. There are three types of Keychains: Login Keychain, System Keychain, and Local Items (iCloud) Keychain. The default Keychain is the Login Keychain, which stores user passwords and information. The System Keychain stores items accessed by the operating system, such as items shared among users on a host. The Local Items (iCloud) Keychain is used for items synced with Apple’s iCloud service. Keychains can be viewed and edited through the Keychain Access application or using the command-line utility security. Keychain files are located in ~/Library/Keychains/, /Library/Keychains/, and /Network/Library/Keychains/. Adversaries may gather user credentials from Keychain storage/memory. For example, the command security dump-keychain –d will dump all Login Keychain credentials from ~/Library/Keychains/login.keychain-db. Adversaries may also directly read Login Keychain credentials from the ~/Library/Keychains/login.keychain file. Both methods require a password, where the default password for the Login Keychain is the current user’s password to login to the macOS host.

Related

Subtechnique of · MITRE ATT&CK (1)

  • T1555 Credentials from Password Stores technique

Tactic · MITRE ATT&CK (1)

  • TA0006 Credential Access tactic

Referenced by MITRE ATT&CK · mitigates (1)

  • M1027 Password Policies mitigation

Referenced by MITRE ATT&CK · uses (13)

  • S9010 GlassWorm software (malware)
  • G1052 Contagious Interview group
  • S1246 BeaverTail software (malware)
  • S1185 LightSpy software (malware)
  • S1153 Cuckoo Stealer software (malware)
  • S1016 MacMa software (malware)
  • S0690 Green Lambert software (malware)
  • S0363 Empire software (tool)
  • S0349 LaZagne software (tool)
  • G0082 APT38 group
  • S0274 Calisto software (malware)
  • S0278 iKitten software (malware)
  • S0279 Proton software (malware)

Referenced by CAPEC · att&ck technique (1)

  • CAPEC-545 Pull Data from System Resources attack pattern

Referenced by Compliance · mitigates (4)

  • CIS-4.11 Enforce Remote Wipe Capability on Portable End-User Devices CIS Safeguard v8.1
  • NIST-CA-7 Continuous Monitoring NIST 800-53 control
  • NIST-IA-5 Authenticator Management NIST 800-53 control
  • NIST-SI-4 System Monitoring NIST 800-53 control

References