T1555.002No distinct observable

Securityd Memory

Credential AccessLinux, macOS

Where this stands

A reviewer read the telemetry and concluded there is nothing here to detect that a sibling technique does not already cover.

The platform that actually has securityd has no usable log source, and the platform with a usable log source has no securityd. AN0156 is the technique-true arm — ptrace/task_for_pid against securityd, and execution of lldb/gdb/osqueryi — but both of its log sources are macos:unifiedlog, which has no standardised Sigma field vocabulary; no rule in this corpus uses that source, and inventing field names for it would violate hard rule 2 and produce a rule that parses in four backends and matches nothing. AN0157 is explicitly an analogy, in MITRE's own words 'credential storage daemons analogous to macOS securityd' — securityd is a macOS daemon and does not exist on Linux, so anything written against auditd here is a rule for gnome-keyring or kwallet filed under a macOS-keychain technique id. Its three legs also fail individually. […]

Covered instead by T1003.007, T1555, T1555.001.

What the technique is

An adversary with root access may gather credentials by reading securityd’s memory. securityd is a service/daemon responsible for implementing security protocols such as encryption and authorization. A privileged adversary may be able to scan through securityd's memory to find the correct sequence of keys to decrypt the user’s logon keychain. This may provide the adversary with various plaintext passwords, such as those for users, WiFi, mail, browsers, certificates, secure notes, etc. In OS X prior to El Capitan, users with root access can read plaintext keychain passwords of logged-in users because Apple’s keychain implementation allows these credentials to be cached so that users are not repeatedly prompted for passwords. Apple’s securityd utility takes the user’s logon password, encrypts it with PBKDF2, and stores this master key in memory. Apple also uses a set of keys and algorithms to encrypt the user’s password, but once the master key is found, an adversary need only iterate over the other values to unlock the final password.

Read it on attack.mitre.org

What MITRE says you would watch

AN0156
Detects suspicious memory access attempts targeting the securityd process. Observes tools invoking process memory read operations (e.g., ptrace, task_for_pid) against securityd. Correlates with anomalous parent process lineage, root privilege escalation, or repeated unauthorized attempts.
AN0157
Detects adversaries attempting to attach debuggers or memory dump utilities to credential storage daemons analogous to macOS securityd. Observes ptrace syscalls, /proc//mem access, or gcore dumps against sensitive processes. Correlates anomalies with privilege escalation or credential dumping attempts.