ATT&CK technique
View on MITRE ATT&CK →
T1555.001
Keychain
Credential Access
7 detections found
Detection rules
| Source | Rule | Status | Updated |
|---|---|---|---|
| splunk | MacOS Keychains Dumped | production | 2026-10-02 |
| elastic | First Time Python Accessed Sensitive Credential Files | production | 2026-09-29 |
| elastic | Dumping of Keychain Content via Security Command | production | 2026-09-18 |
| elastic | SystemKey Access via Command Line | production | 2026-09-18 |
| elastic | Keychain Password Retrieval via Command Line | production | 2026-09-18 |
| elastic | Keychain CommandLine Interaction via Unsigned or Untrusted Process | production | 2026-09-18 |
| sigma | Credentials from Password Stores - Keychain | test | 2021-11-27 |