SystemKey Access via Command Line

[rule]
description = """
Keychains are the built-in way for macOS to keep track of users' passwords and credentials for many services and
features, including Wi-Fi and website passwords, secure notes, certificates, and Kerberos. Adversaries may collect the
keychain storage data from a system to acquire credentials.
"""
id = "7d3f98bf-2111-4e5f-9787-9edef8d94dd0"
license = "Elastic License v2"
name = "SystemKey Access via Command Line"
os_list = ["macos"]
reference = ["https://github.com/AlessandroZ/LaZagne/blob/master/Mac/lazagne/softwares/system/chainbreaker.py"]
version = "1.0.31"

query = '''
process where event.action == "exec" and
  process.command_line like~ "*/private/var/db/SystemKey*" and
  not process.command_line like~ "*/Volumes/*/var/db/SystemKey*" and
  not process.Ext.effective_parent.executable like "/Library/Elastic/Endpoint/elastic-endpoint.app/Contents/MacOS/elastic-endpoint"
'''

min_endpoint_version = "8.7.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1555"
name = "Credentials from Password Stores"
reference = "https://attack.mitre.org/techniques/T1555/"
[[threat.technique.subtechnique]]
id = "T1555.001"
name = "Keychain"
reference = "https://attack.mitre.org/techniques/T1555/001/"



[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[internal]
min_endpoint_version = "8.7.0"