← Back to SOC feed Coverage →

For reading OS X keychain passwords as root.

yara LOW signature-base
florian-roth
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at signature-base →
Retrieved: 2026-05-28T11:00:00Z · Confidence: medium

Hunt Hypothesis

An adversary may attempt to extract sensitive credentials from an OS X keychain by executing commands with root privileges, indicating potential credential theft or lateral movement. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify and mitigate early-stage attacks targeting macOS systems.

YARA Rule

rule hacktool_macos_juuso_keychaindump
{
    meta:
        description = "For reading OS X keychain passwords as root."
        reference = "https://github.com/juuso/keychaindump"
        author = "@mimeframe"
        id = "196c6132-b538-5055-a4cb-e2d46723d06e"
    strings:
        $a1 = "[-] Too many candidate keys to fit in memory" wide ascii
        $a2 = "[-] Could not allocate memory for key search" wide ascii
        $a3 = "[-] Too many credentials to fit in memory" wide ascii
        $a4 = "[-] The target file is not a keychain file" wide ascii
        $a5 = "[-] Could not find the securityd process" wide ascii
        $a6 = "[-] No root privileges, please run with sudo" wide ascii
    condition:
        4 of ($a*)
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

This rule contains 6 string patterns in its detection logic.

References

False Positive Guidance

Original source: https://github.com/Neo23x0/signature-base/blob/main/vendor/yara/airbnb_binaryalert.yar