T1555.001 — Keychain

Tactic: Credential Access · Platforms: macOS

Adversaries may acquire credentials from Keychain. Keychain (or Keychain Services) is the macOS credential management system that stores account names, passwords, private keys, certificates, sensitive application data, payment data, and secure notes. There are three types of Keychains: Login…

Sub-technique of Credentials from Password Stores (T1555).

Sigma detection rules (1)

T1555.001 Credentials from Password Stores: Keychain

title: "T1555.001 Credentials from Password Stores: Keychain"
id: 0d983812-21ef-416b-9728-304c913a3476
description: 'Detect Access to macOS Keychain for Credential Theft. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: AllowedApplications, AlertThreshold, ParentProcessContext.'
references:
  - https://attack.mitre.org/techniques/T1555/001
author: Shahrukh Khan
date: 2026-01-22
license: MIT
tags:
  - attack.credential-access
  - attack.t1555.001

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith: '/security'
    CommandLine|contains|all:
      - 'dump-keychain'
      - '-d'

  condition: selection

falsepositives:
  - Keychain export performed by an administrator during device migration or backup using the security command line tool.

level: high

Related sub-techniques

Explore