Detect Keychain in Google Chronicle

rule T1555_001_Keychain_Access {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects macOS Keychain credential access via security CLI, keychaindump binary, or Keychain Services API abuse in process command lines"
    severity = "HIGH"
    mitre_attack = "T1555.001"
    platform = "macOS"
    created = "2026-04-13"

  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    (
      (
        re.regex($e.target.process.file.full_path, `/security$`) and
        re.regex($e.target.process.command_line, `(dump-keychain|find-generic-password|find-internet-password|find-certificate)`)
      ) or
      re.regex($e.target.process.file.full_path, `keychaindump`) or
      re.regex($e.target.process.command_line, `(keychaindump|SecKeychainFindInternetPassword|SecItemCopyMatching|SecKeychainItemCopyAttributesAndData)`) or
      re.regex($e.target.process.command_line, `Library/Keychains`)
    )

  condition:
    $e
}