← Back to SOC feed Coverage →

This program decrypts / extracts all authorization tokens on macOS / OS X / OSX.

yara LOW signature-base
florian-roth
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at signature-base →
Retrieved: 2026-05-28T11:00:00Z · Confidence: medium

Hunt Hypothesis

The hypothesis is that an adversary is attempting to extract authorization tokens from macOS systems to gain elevated access or exfiltrate sensitive credentials. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify potential credential theft or privilege escalation attempts early.

YARA Rule

rule hacktool_macos_manwhoami_mmetokendecrypt
{
    meta:
        description = "This program decrypts / extracts all authorization tokens on macOS / OS X / OSX."
        reference = "https://github.com/manwhoami/MMeTokenDecrypt"
        author = "@mimeframe"
        id = "8792bf45-9c92-53cf-a288-e38fe2a19642"
    strings:
        $a1 = "security find-generic-password -ws 'iCloud'" wide ascii
        $a2 = "ERROR getting iCloud Decryption Key" wide ascii
        $a3 = "Could not find MMeTokenFile. You can specify the file manually." wide ascii
        $a4 = "Decrypting token plist ->" wide ascii
        $a5 = "Successfully decrypted token plist!" wide ascii
    condition:
        3 of ($a*)
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

This rule contains 5 string patterns in its detection logic.

References

False Positive Guidance

Original source: https://github.com/Neo23x0/signature-base/blob/main/vendor/yara/airbnb_binaryalert.yar