Detection of macOS Keychain Credential Harvesting

Adversaries targeting macOS environments frequently conduct credential harvesting as a post-exploitation activity to facilitate lateral movement and privilege escalation. This threat involves the unauthorized access or exfiltration of Keychain database files, which store sensitive information including application credentials, Wi-Fi passwords, system service accounts, and cryptographic certificates. Attackers typically utilize native macOS utilities such as the security command-line tool, specifically using arguments like dump-keychain or find-certificate to extract data. Alternatively, adversaries may perform direct file manipulation on Keychain databases located in ~/Library/Keychains/, /Library/Keychains/, or /Network/Library/Keychains/ using standard system tools like cat, cp, dd, or mv. Detecting these activities is critical for identifying active unauthorized access to system-stored secrets.

Attack Chain

1. Attacker gains initial access to a macOS system via phishing, malicious software, or exploit.
2. Attacker establishes a shell session and performs local enumeration to identify stored secrets.
3. Attacker targets the user's login keychain or system-wide keychain files for access.
4. Attacker uses /usr/bin/security dump-keychain -d to attempt to export decrypted credentials.
5. Attacker executes security find-certificate -p to harvest certificates for further malicious use.
6. Attacker leverages file utilities such as cp or dd to copy .keychain database files to an accessible directory.
7. Attacker exfiltrates the database files to external infrastructure or parses them offline.
8. Attacker uses harvested credentials to escalate privileges or move laterally within the organization.

Impact

Successful harvesting of Keychain data allows attackers to gain persistent access to sensitive services and accounts. Because the Keychain often contains credentials for cloud services, internal network infrastructure, and administrative tools, compromise often leads to full account takeover or further compromise of the internal network. The scope of impact is limited to the local system and the individual credentials stored within that specific user or system keychain.

Recommendation

Prioritize monitoring for unauthorized execution of the security utility and unexpected access to Keychain directory paths.

• Deploy process monitoring (e.g., Osquery or Endpoint Security) to audit executions of /usr/bin/security.
• Implement monitoring for standard file manipulation tools (cat, cp, dd, mv) targeting files ending in .keychain within the standard macOS library paths.
• Baseline administrator activity to differentiate legitimate troubleshooting from malicious credential harvesting.
• Integrate the provided Splunk search logic into your SIEM to monitor for the specific process command-line arguments mentioned in the overview.