Detect Securityd Memory in Sumo Logic CSE
An adversary with root access may gather credentials by reading securityd's memory. securityd is a macOS service/daemon responsible for implementing security protocols such as encryption and authorization. A privileged adversary may scan through securityd's memory to find the correct sequence of keys to decrypt the user's logon keychain, yielding various plaintext passwords including user accounts, WiFi, mail, browsers, certificates, and secure notes. In OS X prior to El Capitan, users with root access could read plaintext keychain passwords of logged-in users because Apple's keychain implementation cached these credentials in securityd memory.
MITRE ATT&CK
- Tactic
- Credential Access
- Technique
- T1555 Credentials from Password Stores
- Sub-technique
- T1555.002 Securityd Memory
- Canonical reference
- https://attack.mitre.org/techniques/T1555/002/
Sumo Detection Query
(_sourceCategory=*mac* OR _sourceCategory=*osquery* OR _sourceCategory=*syslog* OR _sourceCategory=*endpoint*)
| where (
toLowerCase(%process_name) in ("keychaindump", "chainbreaker", "keychain-dumper", "kcpassword")
or toLowerCase(%cmdline) matches "(?s).*(keychaindump|chainbreaker|keychain-dumper|kcpassword).*"
or (
toLowerCase(%process_name) in ("vmmap", "lldb", "dtrace", "heap", "sample", "leaks", "gdb")
and toLowerCase(%cmdline) matches "(?s).*securityd.*"
)
or (
toLowerCase(%cmdline) matches "(?s).*task_for_pid.*"
and toLowerCase(%cmdline) matches "(?s).*securityd.*"
)
)
| eval KeychainDumpTool = if (toLowerCase(%cmdline) matches "(?s).*(keychaindump|chainbreaker|keychain-dumper|kcpassword).*"
or toLowerCase(%process_name) in ("keychaindump", "chainbreaker", "keychain-dumper", "kcpassword"), 1, 0)
| eval MemoryAccessTool = if (
toLowerCase(%process_name) in ("vmmap", "lldb", "dtrace", "heap", "sample", "leaks", "gdb")
and toLowerCase(%cmdline) matches "(?s).*securityd.*", 1, 0)
| eval TaskForPid = if (
toLowerCase(%cmdline) matches "(?s).*task_for_pid.*"
and toLowerCase(%cmdline) matches "(?s).*securityd.*", 1, 0)
| eval SuspicionScore = (KeychainDumpTool * 3) + (MemoryAccessTool * 2) + (TaskForPid * 2)
| where SuspicionScore > 0
| fields _messagetime, _sourceHost, %user, %process_name, %cmdline, KeychainDumpTool, MemoryAccessTool, TaskForPid, SuspicionScore
| sort by SuspicionScore desc, _messagetime descSumo Logic query detecting macOS securityd memory access for credential theft (T1555.002). Targets macOS syslog, osquery, and endpoint source categories. Identifies known keychain dump tools by process name or command line, memory inspection utilities (vmmap, lldb, dtrace, heap, sample, leaks, gdb) when securityd appears in arguments, and task_for_pid calls targeting securityd. Weighted suspicion scoring prioritises dedicated keychain tools (score 3) over general memory inspection (score 2).
Data Sources
Required Tables
False Positives & Tuning
- Security team members conducting sanctioned macOS forensic investigations using chainbreaker or keychain-dumper against seized or test endpoints under documented authorization
- macOS software developers using lldb in debugging sessions where securityd appears in argument lists as part of inter-process debugging workflows on development machines
- Endpoint management platforms (Jamf, Mosyle) that trigger heap or vmmap diagnostics against macOS system daemons including securityd as part of automated health-check or crash-collection pipelines
Other platforms for T1555.002
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Run keychaindump to extract credentials from securityd memory
Expected signal: macOS Unified Log: process execution for keychaindump with root privileges. ESF process_exec and task_for_pid events. If SIP is enabled, the command will fail with a permission error — but the attempt is still logged.
- Test 2Attach debugger to securityd process
Expected signal: macOS Unified Log: lldb process creation with securityd PID argument. ESF task_for_pid event from lldb to securityd. If SIP is enabled, lldb will be denied attachment.
- Test 3Map securityd virtual memory with vmmap
Expected signal: macOS Unified Log: vmmap process creation with securityd PID. ESF process execution event. The vmmap output reveals memory layout but does not extract credentials directly.
References (6)
- https://attack.mitre.org/techniques/T1555/002/
- https://web.archive.org/web/20130106164109/https://juusosalonen.com/post/30923743427/breaking-into-the-os-x-keychain
- https://developer.apple.com/library/archive/documentation/Security/Conceptual/Security_Overview/Architecture/Architecture.html
- https://www.welivesecurity.com/2016/07/06/new-osxkeydnap-malware-hungry-credentials/
- https://www.slideshare.net/slideshow/external-to-da-the-os-x-way/62021418
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1555.002/T1555.002.md
Unlock Pro Content
Get the full detection package for T1555.002 including response playbook, investigation guide, and atomic red team tests.