User Keychain DB Access by Osascript

[rule]
description = """
Detects when OsaScript attempts to open the user's Keychain DB. This activity is not normal and should be considered
suspicious. The macOS keychain is highly sought after and targeted by threat actors as it contains sensitive credential
data that can be used to further compromise a user or environment.
"""
id = "e89a6e10-7568-4b02-807c-596d51b65fbc"
license = "Elastic License v2"
name = "User Keychain DB Access by Osascript"
os_list = ["macos"]
reference = ["https://github.com/MythicAgents/apfell"]
version = "1.0.10"

query = '''
file where event.action == "open" and 
 file.name like "login.keychain-db" and 
 process.name == "osascript"
'''

min_endpoint_version = "8.10.2"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1555"
name = "Credentials from Password Stores"
reference = "https://attack.mitre.org/techniques/T1555/"
[[threat.technique.subtechnique]]
id = "T1555.001"
name = "Keychain"
reference = "https://attack.mitre.org/techniques/T1555/001/"



[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[internal]
min_endpoint_version = "8.10.2"