Keychain Dump via Native Security Tool

[rule]
description = """
Detects the dumping of the Apple keychain using the native "security" binary by a suspicious parent process. Dumping the
keychain file using these binaries should not be commonplace and should be considered highly abnormal, possibly
indicating malicious activity. The Apple keychain contains sensitive and valuable data an attacker could utilize to
escalate privileges, move laterally and further compromise a system or account.
"""
id = "549344d6-aaef-4495-9ca2-7a0b849bf571"
license = "Elastic License v2"
name = "Keychain Dump via Native Security Tool"
os_list = ["macos"]
reference = ["https://github.com/its-a-feature/LockSmith"]
version = "1.0.26"

query = '''
process where event.action == "exec" and process.name == "security" and 
 ((process.args like~ "dump-keychain" and process.args == "-d") or (process.args like~ "dump")) and
 process.Ext.effective_parent.executable != null and
 not process.Ext.effective_parent.executable like ("/Library/Application Support/JAMF/Jamf.app/Contents/MacOS/JamfDaemon.app/Contents/MacOS/JamfDaemon",
                                                   "/usr/local/jamf/bin/jamf",
                                                   "/Library/Application Support/JAMF/Jamf.app/Contents/MacOS/JamfManagementService.app/Contents/MacOS/JamfManagementService",
                                                   "/Library/Application Support/DARE/Bin/dareupdate",
                                                   "/usr/libexec/xpcproxy",
                                                   "/Library/Application Support/DARE/Zappl/Bin/zappl")
'''

min_endpoint_version = "8.10.2"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1555"
name = "Credentials from Password Stores"
reference = "https://attack.mitre.org/techniques/T1555/"
[[threat.technique.subtechnique]]
id = "T1555.001"
name = "Keychain"
reference = "https://attack.mitre.org/techniques/T1555/001/"



[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[internal]
min_endpoint_version = "8.10.2"