Rare process accessed a Keychain file

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	XDR Agent with eXtended Threat Hunting (XTH)
Detector Tags	Credentials Grabbing Analytics
ATT&CK Tactic	Credential Access (TA0006)
ATT&CK Technique	Credentials from Password Stores: Keychain (T1555.001)
Severity	Informational

Description

An unusual process accessed a Keychain file. This might indicate a credential-grabbing attempt.

Attacker's Goals

Obtain access to credentials stored in the Keychain file.

Investigative actions

• Determine whether it is legitimate for the process to access credential data directly.
• Analyze the process/application that touched the Keychain.
• Check for any other suspicious actions that were performed by the process.
• Look for unusual access to resources using credentials stored on said Keychain.

Variations

Rare process accessed a Keychain file using the networksetup tool

Synopsis

Field	Value
ATT&CK Tactic	Credential Access (TA0006), Reconnaissance (TA0043)
ATT&CK Technique	Credentials from Password Stores: Keychain (T1555.001), Gather Victim Host Information (T1592)
Severity	High

Description

An unusual process accessed a Keychain file. This might indicate a credential-grabbing attempt.

Attacker's Goals

Obtain access to credentials stored in the Keychain file.

Investigative actions

• Determine whether it is legitimate for the process to access credential data directly.
• Analyze the process/application that touched the Keychain.
• Check for any other suspicious actions that were performed by the process.
• Look for unusual access to resources using credentials stored on said Keychain.

Rare process accessed a Keychain file while installing a new certificate

Synopsis

Field	Value
ATT&CK Tactic	Credential Access (TA0006), Defense Evasion (TA0005)
ATT&CK Technique	Credentials from Password Stores: Keychain (T1555.001), Subvert Trust Controls: Install Root Certificate (T1553.004)
Severity	Medium

Description

An unusual process accessed a Keychain file. This might indicate a credential-grabbing attempt.

Attacker's Goals

Obtain access to credentials stored in the Keychain file.

Investigative actions

• Determine whether it is legitimate for the process to access credential data directly.
• Analyze the process/application that touched the Keychain.
• Check for any other suspicious actions that were performed by the process.
• Look for unusual access to resources using credentials stored on said Keychain.

Rare process accessed a Keychain file initiated by a causality actor with a rare path

Synopsis

Field	Value
ATT&CK Tactic	Credential Access (TA0006)
ATT&CK Technique	Credentials from Password Stores: Keychain (T1555.001)
Severity	Low

Description

An unusual process accessed a Keychain file. This might indicate a credential-grabbing attempt.

Attacker's Goals

Obtain access to credentials stored in the Keychain file.

Investigative actions

• Determine whether it is legitimate for the process to access credential data directly.
• Analyze the process/application that touched the Keychain.
• Check for any other suspicious actions that were performed by the process.
• Look for unusual access to resources using credentials stored on said Keychain.

Rare process accessed a Keychain file initiated by an unsigned causality actor

Synopsis

Field	Value
ATT&CK Tactic	Credential Access (TA0006)
ATT&CK Technique	Credentials from Password Stores: Keychain (T1555.001)
Severity	Low

Description

An unusual process accessed a Keychain file. This might indicate a credential-grabbing attempt.

Attacker's Goals

Obtain access to credentials stored in the Keychain file.

Investigative actions

• Determine whether it is legitimate for the process to access credential data directly.
• Analyze the process/application that touched the Keychain.
• Check for any other suspicious actions that were performed by the process.
• Look for unusual access to resources using credentials stored on said Keychain.

Rare unsigned process accessed a Keychain file

Synopsis

Field	Value
ATT&CK Tactic	Credential Access (TA0006)
ATT&CK Technique	Credentials from Password Stores: Keychain (T1555.001)
Severity	Low

Description

An unusual process accessed a Keychain file. This might indicate a credential-grabbing attempt.

Attacker's Goals

Obtain access to credentials stored in the Keychain file.

Investigative actions

• Determine whether it is legitimate for the process to access credential data directly.
• Analyze the process/application that touched the Keychain.
• Check for any other suspicious actions that were performed by the process.
• Look for unusual access to resources using credentials stored on said Keychain.