T1555.001 Keychain — Attack Simulation

Adversaries may acquire credentials from Keychain. Keychain (or Keychain Services) is the macOS credential management system that stores account names, passwords, private keys, certificates, sensitive application data, payment data, and secure notes. There are three types of Keychains: Login Keychain, System Keychain, and Local Items (iCloud) Keychain. The default Keychain is the Login Keychain, which stores user passwords and information. The…

Technique description

At least one platform-compatible Atomic procedure is documented. Individual review, lab prerequisites, and validation remain required.

Official ATT&CK definition · Detection rules and anomaly models

Documented simulation candidates

Export Certificate Item(s)
macos automated sh
Procedure 1864fdec-ff86-4452-8c30-f12507582a93; elevation not declared required; cleanup present, not reviewed. Not executed or individually validated.
Copy Keychain using cat utility
macos automated sh
Procedure 5c32102a-c508-49d3-978f-288f8a9f6617; elevation not declared required; cleanup present, not reviewed. Not executed or individually validated.
Keychain Dump
macos automated sh
Procedure 88e1fa00-bf63-4e5b-a3e1-e2ea51c8cca6; elevation required; cleanup not declared. Not executed or individually validated.
Import Certificate Item(s) into Keychain
macos automated sh
Procedure e544bbcb-c4e0-4bd0-b614-b92131635f59; elevation not declared required; cleanup not declared. Not executed or individually validated.

Connected ecosystem references

Linked tags

enterprise onprem macOS credential-access isolated_authorized_lab procedure_review_required telemetry_configuration_required some_candidates_require_elevation

can_simulate subtechnique source_mapped

Detection and collection

T1555.001 detection workspace

Attack tools

Threat actor context

These are explicit actor-to-technique associations in the existing Threat Matrix snapshot, not attribution of an event or proof that a detector identifies the actor. No tool-to-actor relationship is inferred.

Contagious Interview · G1052

Existing research

Threat Matrix: knowledge routes, evidence and actor context

Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.