Keychain CommandLine Interaction via Unsigned or Untrusted Process

  1[metadata]
  2creation_date = "2020/08/14"
  3integration = ["endpoint"]
  4maturity = "production"
  5updated_date = "2025/04/21"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Adversaries may collect the keychain storage data from a system to acquire credentials. Keychains are the built-in way
 11for macOS to keep track of users' passwords and credentials for many services and features such as WiFi passwords,
 12websites, secure notes and certificates.
 13"""
 14from = "now-9m"
 15index = ["logs-endpoint.events.process*"]
 16language = "eql"
 17license = "Elastic License v2"
 18name = "Keychain CommandLine Interaction via Unsigned or Untrusted Process"
 19references = [
 20    "https://objective-see.com/blog/blog_0x25.html",
 21    "https://securelist.com/calisto-trojan-for-macos/86543/",
 22]
 23risk_score = 73
 24rule_id = "96e90768-c3b7-4df6-b5d9-6237f8bc36a8"
 25setup = """## Setup
 26
 27This rule requires data coming in from Elastic Defend.
 28
 29### Elastic Defend Integration Setup
 30Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
 31
 32#### Prerequisite Requirements:
 33- Fleet is required for Elastic Defend.
 34- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
 35
 36#### The following steps should be executed in order to add the Elastic Defend integration on a macOS System:
 37- Go to the Kibana home page and click "Add integrations".
 38- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
 39- Click "Add Elastic Defend".
 40- Configure the integration name and optionally add a description.
 41- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
 42- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
 43- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
 44- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
 45For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/current/agent-policy.html).
 46- Click "Save and Continue".
 47- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
 48For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
 49"""
 50severity = "high"
 51tags = [
 52    "Domain: Endpoint",
 53    "OS: macOS",
 54    "Use Case: Threat Detection",
 55    "Tactic: Credential Access",
 56    "Data Source: Elastic Defend",
 57    "Resources: Investigation Guide",
 58]
 59timestamp_override = "event.ingested"
 60type = "eql"
 61
 62query = '''
 63process where host.os.type == "macos" and event.type in ("start", "process_started") and event.action == "exec" and
 64  process.args like ("/Users/*/Library/Keychains/*", "/Library/Keychains/*", "login.keychain-db", "login.keychain") and 
 65  ((process.code_signature.trusted == false or process.code_signature.exists == false) or 
 66   (process.name in ("bash", "sh", "zsh", "osascript", "cat", "echo", "cp") and 
 67   (process.parent.code_signature.trusted == false or process.parent.code_signature.exists == false)))
 68'''
 69note = """## Triage and analysis
 70
 71> **Disclaimer**:
 72> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
 73
 74### Investigating Keychain CommandLine Interaction via Unsigned or Untrusted Process
 75
 76macOS keychains securely store user credentials, such as passwords and certificates, essential for system and application authentication. Adversaries may target these directories to extract sensitive information, potentially compromising user accounts and system integrity. The detection rule identifies suspicious access attempts by monitoring process activities related to keychain directories, excluding known legitimate processes and actions, thus highlighting potential unauthorized access attempts.
 77
 78### Possible investigation steps
 79
 80- Review the process details that triggered the alert, focusing on the process.args field to identify the specific keychain directory accessed and the nature of the access attempt.
 81- Examine the process.parent.executable and process.executable fields to determine the origin of the process and assess whether it is a known or potentially malicious application.
 82- Investigate the process.Ext.effective_parent.executable field to trace the parent process chain and identify any unusual or unauthorized parent processes that may have initiated the access.
 83- Check for any recent changes or installations on the system that could explain the access attempt, such as new software or updates that might interact with keychain directories.
 84- Correlate the alert with other security events or logs from the same host to identify any patterns or additional suspicious activities that could indicate a broader compromise.
 85
 86### False positive analysis
 87
 88- Processes related to legitimate security applications like Microsoft Defender, JumpCloud Agent, and Rapid7 IR Agent may trigger false positives. Users can mitigate this by ensuring these applications are included in the exclusion list for process executables and effective parent executables.
 89- Routine administrative tasks involving keychain management, such as setting keychain settings or importing certificates, might be flagged. To handle this, users should add these specific actions to the exclusion list for process arguments.
 90- Applications like OpenVPN Connect and JAMF management tools that interact with keychain directories for legitimate purposes can cause false alerts. Users should verify these applications are part of the exclusion list for parent executables to prevent unnecessary alerts.
 91- Regular system maintenance or updates that involve keychain access might be misinterpreted as suspicious. Users should monitor these activities and adjust the exclusion criteria as needed to accommodate known maintenance processes.
 92
 93### Response and remediation
 94
 95- Immediately isolate the affected macOS system from the network to prevent further unauthorized access or data exfiltration.
 96- Terminate any suspicious processes identified by the detection rule that are attempting to access keychain directories without legitimate reasons.
 97- Conduct a thorough review of the system's keychain access logs to identify any unauthorized access or modifications to keychain files.
 98- Change all passwords and credentials stored in the keychain on the affected system to prevent potential misuse of compromised credentials.
 99- Restore the system from a known good backup if unauthorized access has led to system integrity issues or data corruption.
100- Implement additional monitoring on the affected system to detect any further unauthorized access attempts, focusing on the keychain directories and related processes.
101- Escalate the incident to the security operations team for further investigation and to determine if the threat is part of a larger attack campaign."""
102
103
104[[rule.threat]]
105framework = "MITRE ATT&CK"
106[[rule.threat.technique]]
107id = "T1555"
108name = "Credentials from Password Stores"
109reference = "https://attack.mitre.org/techniques/T1555/"
110[[rule.threat.technique.subtechnique]]
111id = "T1555.001"
112name = "Keychain"
113reference = "https://attack.mitre.org/techniques/T1555/001/"
114
115
116
117[rule.threat.tactic]
118id = "TA0006"
119name = "Credential Access"
120reference = "https://attack.mitre.org/tactics/TA0006/"