Keychain
Subtechnique · ATTACK:enterprise:T1555.001
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1555.001",
"title": "Keychain",
"type": "Subtechnique",
"source_url": "https://attack.mitre.org/techniques/T1555/001",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--1eaebf46-e361-4437-bc23-d5d65a3b92e3",
"external_id": "T1555.001",
"domain": "enterprise",
"created": "2020-02-12T18:55:24.728Z",
"modified": "2026-05-12T15:12:00.622Z",
"version": "1.1",
"aliases": [
],
"tactics": [
"credential-access"
],
"source_references": [
{
"source_name": "External to DA, the OS X Way",
"url": "https://www.slideshare.net/slideshow/external-to-da-the-os-x-way/62021418"
},
{
"source_name": "Keychain Services Apple",
"url": "https://developer.apple.com/documentation/security/keychain_services"
},
{
"source_name": "Empire Keychain Decrypt",
"url": "https://github.com/EmpireProject/Empire/blob/08cbd274bef78243d7a8ed6443b8364acd1fc48b/lib/modules/python/collection/osx/keychaindump_decrypt.py"
},
{
"source_name": "OSX Keychain Schaumann",
"url": "https://www.netmeister.org/blog/keychain-passwords.html"
},
{
"source_name": "Keychain Decryption Passware",
"url": "https://support.passware.com/hc/en-us/articles/4573379868567-A-Deep-Dive-into-Apple-Keychain-Decryption"
}
]
}Explicit source assertions (15)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:G1052 → uses → ATTACK:enterprise:T1555.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--07d5e168-372a-493e-abb2-904c55b9fe3b
Sekoia ClickFake 2025 · Socket BeaverTail XORIndex HexEval Contagious Interview July 2025 · Socket HexEval BeaverTail Contagious Interview June 2025ATTACK:enterprise:S1185 → uses → ATTACK:enterprise:T1555.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2d92fdbd-6733-4e86-b234-a805fecf676b
Huntress LightSpy macOS 2024ATTACK:enterprise:S9010 → uses → ATTACK:enterprise:T1555.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--354b2d56-9b68-4481-b05d-b72a347bb4a7
Koi Glassworm New Tricks December 2025 · Socket GlassWorm January 2026ATTACK:enterprise:S0690 → uses → ATTACK:enterprise:T1555.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--46970d57-04cb-4ffb-9c7e-ff66c0811f25
Objective See Green Lambert for OSX Oct 2021 · Glitch-Cat Green Lambert ATTCK Oct 2021ATTACK:enterprise:S0363 → uses → ATTACK:enterprise:T1555.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--558132f8-5d0f-4c77-b3a2-b7e9c060a3f5
Empire Keychain DecryptATTACK:enterprise:S0279 → uses → ATTACK:enterprise:T1555.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6209bf2d-6ffd-4740-96cb-ef04379ae126
objsee mac malware 2017ATTACK:enterprise:S1016 → uses → ATTACK:enterprise:T1555.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--86fd8738-ab8f-4b80-8c8d-fc80df9e2c07
ESET DazzleSpy Jan 2022ATTACK:enterprise:M1027 → mitigates → ATTACK:enterprise:T1555.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8e620d3d-6766-4f26-a6ae-d7fd1276916f
ATTACK:enterprise:S0349 → uses → ATTACK:enterprise:T1555.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b32c6aa0-9299-4ada-a626-9805ba1f1610
GitHub LaZagne Dec 2018ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1555.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b6d10f57-dec0-4fe3-910d-fc966c58f3f5
Microsoft Sapphire Sleet APR 2026ATTACK:enterprise:T1555.001 → subtechnique-of → ATTACK:enterprise:T1555
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c9a1bcec-9a4d-4693-accb-5a6f67b857f6
ATTACK:enterprise:S0274 → uses → ATTACK:enterprise:T1555.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d22b326c-ceaf-424b-b263-e0830bab9bf3
Securelist Calisto July 2018 · Symantec Calisto July 2018ATTACK:enterprise:S1153 → uses → ATTACK:enterprise:T1555.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e14893ce-24b2-41b0-9597-7775e2f71dc5
Kandji Cuckoo April 2024ATTACK:enterprise:S0278 → uses → ATTACK:enterprise:T1555.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f5cf9158-6f25-4167-8263-5a356bf816b9
objsee mac malware 2017ATTACK:enterprise:S1246 → uses → ATTACK:enterprise:T1555.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f7a0e6c8-5835-437a-b7ee-4d1421ed37a5
Socket BeaverTail XORIndex HexEval Contagious Interview July 2025 · Socket HexEval BeaverTail Contagious Interview June 2025 · ESET Contagious Interview BeaverTail InvisibleFerret February 2025