atomic-red-team/Mac/Credential_Access/Keychain.md

Keychain

MITRE ATT&CK Technique: T1142

Keychain Files

~/Library/Keychains/

/Library/Keychains/

/Network/Library/Keychains/

security command line

Input:

security -h

Input:

security find-certificate -a -p > allcerts.pem

Input:

security import /tmp/certs.pem -k

References

Security Reference

Keychain dumper