User Keychain Access in Unusual Location

[rule]
description = """
Detects when the user keychain database is accessed in a location outside of it standard location on the system. This
can indicate that the database has been moved or copied from its original location by a malicious payload.
"""
id = "21672f84-ba65-43cf-856a-88083163da09"
license = "Elastic License v2"
name = "User Keychain Access in Unusual Location"
os_list = ["macos"]
reference = [
    "https://www.virustotal.com/gui/file/748581bf2586b76e9cbe550678dcbebde4ec56d1d9fa6bb8c3877878bc8a8fc2",
]
version = "1.0.7"

query = '''
file where event.action in ("modification", "rename", "open") and file.name == "login.keychain-db" and 
 not file.path like~ ("/Users/*/Library/Keychains/*", "/Volumes/*", "/private/var/*") and
 not process.code_signature.subject_name == "Software Signing" and
 not process.code_signature.team_id in ("UBF8T346G9", "JQ525L2MZD", "W8F64X92K3", "PXPZ95SK77")
'''

min_endpoint_version = "8.10.2"
optional_actions = []
[[actions]]
action = "kill_process"
field = "Effective_process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1555"
name = "Credentials from Password Stores"
reference = "https://attack.mitre.org/techniques/T1555/"
[[threat.technique.subtechnique]]
id = "T1555.001"
name = "Keychain"
reference = "https://attack.mitre.org/techniques/T1555/001/"



[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[internal]
min_endpoint_version = "8.10.2"