attack_technique: T1555.001
display_name: 'Credentials from Password Stores: Keychain'
atomic_tests:
- name: Keychain
  auto_generated_guid: 1864fdec-ff86-4452-8c30-f12507582a93
  description: |
    ### Keychain Files

      ~/Library/Keychains/

      /Library/Keychains/

      /Network/Library/Keychains/

      [Security Reference](https://developer.apple.com/legacy/library/documentation/Darwin/Reference/ManPages/man1/security.1.html)

      [Keychain dumper](https://github.com/juuso/keychaindump)
  supported_platforms:
  - macos
  input_arguments:
    cert_export:
      description: Specify the path of the certificates to export.
      type: Path
      default: /tmp/certs.pem
  executor:
    command: |
      security -h
      security find-certificate -a -p > #{cert_export}
      security import #{cert_export} -k
    name: sh
