Michael Haag
30 lines
599 B
YAML
30 lines
599 B
YAML
---
|
|
attack_technique: T1142
|
|
display_name: Keychain
|
|
|
|
atomic_tests:
|
|
- name: Keychain
|
|
description: |
|
|
### Keychain Files
|
|
|
|
~/Library/Keychains/
|
|
|
|
/Library/Keychains/
|
|
|
|
/Network/Library/Keychains/
|
|
|
|
[Security Reference](https://developer.apple.com/legacy/library/documentation/Darwin/Reference/ManPages/man1/security.1.html)
|
|
|
|
[Keychain dumper](https://github.com/juuso/keychaindump)
|
|
|
|
|
|
supported_platforms:
|
|
- macos
|
|
|
|
executor:
|
|
name: sh
|
|
command: |
|
|
security -h
|
|
security find-certificate -a -p > allcerts.pem
|
|
security import /tmp/certs.pem -k
|