T1555.002 — Securityd Memory

Tactic: Credential Access · Platforms: Linux, macOS

An adversary with root access may gather credentials by reading `securityd`’s memory. `securityd` is a service/daemon responsible for implementing security protocols such as encryption and authorization. A privileged adversary may be able to scan through `securityd`'s memory to find the correct…

Sub-technique of Credentials from Password Stores (T1555).

Sigma detection rules (2)

T1555.002 Credentials from Password Stores: Securityd Memory

title: "T1555.002 Credentials from Password Stores: Securityd Memory"
id: dce19034-c50c-4e5c-b358-03c62af387ac
description: 'This sub-technique (macOS securityd/login-keychain memory scraping) is macOS-specific and has no direct Linux equivalent -- Linux has no securityd process. The previous rule reduced this to "ptrace called by gdb/python3/strace," an extremely generic debugger-usage signature with no connection to credential/keyring memory extraction. As the closest Linux analogue and defensible proxy, this rule narrows to ptrace/gcore invocations whose own command line names a credential-holding daemon (gnome-keyring-daemon, kwallet, ssh-agent, gpg-agent) as their evident target -- e.g. wrapper scripts like `gdb -p $(pgrep gnome-keyring-daemon)`. Note this is a partial proxy: auditd does not resolve a ptrace target PID to a process name within the SYSCALL/EXECVE record, so attacks that hardcode a numeric PID without naming the target process in argv will not be caught. Tune using: MonitoredProcesses, CorrelationDepth, PrivilegeContext.'
references:
  - https://attack.mitre.org/techniques/T1555/002
author: Shahrukh Khan
date: 2026-01-31
license: MIT
tags:
  - attack.credential-access
  - attack.t1555.002

logsource:
  category: process_access
  product: linux
  service: auditd

detection:
  selection_tool:
    type: EXECVE
    a0|endswith:
      - '/gdb'
      - '/strace'
      - '/gcore'
  selection_target_hint:
    - a1|contains:
        - 'gnome-keyring'
        - 'kwallet'
        - 'ssh-agent'
        - 'gpg-agent'
        - 'keyctl'
    - a2|contains:
        - 'gnome-keyring'
        - 'kwallet'
        - 'ssh-agent'
        - 'gpg-agent'
        - 'keyctl'
    - a3|contains:
        - 'gnome-keyring'
        - 'kwallet'
        - 'ssh-agent'
        - 'gpg-agent'
        - 'keyctl'

  condition: selection_tool and selection_target_hint

falsepositives:
  - Developers/administrators legitimately debugging a keyring or agent daemon; PID-only invocations (no process name in argv) are a known blind spot and will not trigger this rule.

level: medium

T1555.002 Credentials from Password Stores: Securityd Memory

title: "T1555.002 Credentials from Password Stores: Securityd Memory"
id: aacd6f78-ec3b-4b21-b9fc-88d6057a921a
description: 'Detect Suspicious Access to securityd Memory for Credential Extraction. (Retargeted to the process_access macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: AllowedDebuggers, TimeWindow, PrivilegedUsers.'
references:
  - https://attack.mitre.org/techniques/T1555/002
author: Shahrukh Khan
date: 2026-03-28
license: MIT
tags:
  - attack.credential-access
  - attack.t1555.002

logsource:
  category: process_access
  product: macos

detection:
  selection:
    TargetImage|endswith: '/securityd'
  filter_signed:
    SourceImage|startswith:
      - '/System/Library/'
      - '/usr/libexec/'

  condition: selection and not filter_signed

falsepositives:
  - Apple system diagnostic and crash reporting tools legitimately attach to securityd during normal operation, and unified log does not expose task_for_pid calls directly so this is inferential only.

level: high

Related sub-techniques

Explore