Rare process accessed a Keychain file

Cortex XDR Analytics Alert Reference by data source

Product

Cortex XDR

Last date published

2024-12-03

Synopsis

Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	Requires: XDR Agent with eXtended Threat Hunting (XTH)
Detection Modules
Detector Tags	Credentials Grabbing Analytics
ATT&CK Tactic	Credential Access (TA0006)
ATT&CK Technique	Credentials from Password Stores: Keychain (T1555.001)
Severity	Informational

Description

An unusual process accessed a Keychain file. This might indicate a credential grabbing attempt.

Attacker's Goals

Obtain access to credentials stored in the Keychain file.

Investigative actions

Determine whether it is legitimate for the process to access credential data directly.
Analyze the process/application that touched the Keychain.
Check for any other suspicious actions that were performed by the process.
Look for unusual access to resources using credentials stored on said Keychain.

Variations

Rare process accessed a Keychain file using the networksetup tool

Synopsis

ATT&CK Tactic

ATT&CK Technique

Severity

High

Description

An unusual process accessed a Keychain file. This might indicate a credential grabbing attempt.

Attacker's Goals

Obtain access to credentials stored in the Keychain file.

Investigative actions

Determine whether it is legitimate for the process to access credential data directly.
Analyze the process/application that touched the Keychain.
Check for any other suspicious actions that were performed by the process.
Look for unusual access to resources using credentials stored on said Keychain.

Rare process accessed a Keychain file while installing a new certificate

Synopsis

ATT&CK Tactic

ATT&CK Technique

Severity

Medium

Description

An unusual process accessed a Keychain file. This might indicate a credential grabbing attempt.

Attacker's Goals

Obtain access to credentials stored in the Keychain file.

Investigative actions

Determine whether it is legitimate for the process to access credential data directly.
Analyze the process/application that touched the Keychain.
Check for any other suspicious actions that were performed by the process.
Look for unusual access to resources using credentials stored on said Keychain.

Rare process accessed a Keychain file initiated by a causality actor with a rare path

Synopsis

ATT&CK Tactic	Credential Access (TA0006)
ATT&CK Technique	Credentials from Password Stores: Keychain (T1555.001)
Severity	Low

Description

An unusual process accessed a Keychain file. This might indicate a credential grabbing attempt.

Attacker's Goals

Obtain access to credentials stored in the Keychain file.

Investigative actions

Determine whether it is legitimate for the process to access credential data directly.
Analyze the process/application that touched the Keychain.
Check for any other suspicious actions that were performed by the process.
Look for unusual access to resources using credentials stored on said Keychain.

Rare process accessed a Keychain file initiated by an unsigned causality actor

Synopsis

ATT&CK Tactic	Credential Access (TA0006)
ATT&CK Technique	Credentials from Password Stores: Keychain (T1555.001)
Severity	Low

Description

An unusual process accessed a Keychain file. This might indicate a credential grabbing attempt.

Attacker's Goals

Obtain access to credentials stored in the Keychain file.

Investigative actions

Determine whether it is legitimate for the process to access credential data directly.
Analyze the process/application that touched the Keychain.
Check for any other suspicious actions that were performed by the process.
Look for unusual access to resources using credentials stored on said Keychain.

Rare unsigned process accessed a Keychain file

Synopsis

ATT&CK Tactic	Credential Access (TA0006)
ATT&CK Technique	Credentials from Password Stores: Keychain (T1555.001)
Severity	Low

Description

An unusual process accessed a Keychain file. This might indicate a credential grabbing attempt.

Attacker's Goals

Obtain access to credentials stored in the Keychain file.

Investigative actions

Determine whether it is legitimate for the process to access credential data directly.
Analyze the process/application that touched the Keychain.
Check for any other suspicious actions that were performed by the process.
Look for unusual access to resources using credentials stored on said Keychain.