T1555.001sub-technique of T1555 Credentials from Password Stores

Keychain

macOSnothing on this site yetT1555.001 on attack.mitre.org

Adversaries may acquire credentials from Keychain. Keychain (or Keychain Services) is the macOS credential management system that stores account names, passwords, private keys, certificates, sensitive application data, payment data, and secure notes. There are three types of Keychains: Login Keychain, System Keychain, and Local Items (iCloud) Keychain. The default Keychain is the Login Keychain, which stores user passwords and information.
MITRE ATT&CK 19.2, retrieved 2026-09-12

If this is happening now

Checklists and playbooks to open while the alert is still live.

Playbook for this stage

Cloud account compromise

Impossible travel, an unrecognised inbox rule, or a reported invoice-fraud attempt.

how MITRE says to see it

Detect Access to macOS Keychain for Credential Theft

Detects suspicious access to macOS Keychain files and APIs. Observes processes invoking the 'security' utility or accessing Keychain databases directly, correlates these with abnormal parent process lineage or unexpected user context.

what reduces it

M1027 Password Policies. The password for the user's login keychain can be changed from the user's login password. This increases the complexity for an adversary because they need to know an additional password.

the rest of T1555

T1555.002 Securityd Memory · not covered yet
T1555.003 Credentials from Web Browsers · not covered yet
T1555.004 Windows Credential Manager · not covered yet
T1555.005 Password Managers · not covered yet
T1555.006 Cloud Secrets Management Stores · not covered yet

The description, detection analytics and mitigations are reproduced from MITRE ATT&CK, version 19.2, under its terms of use. The checklists, hunts, labs and everything else linked here are this site’s.