Skip to content

Add macOS Keychain password retrieval detection - #6181

Closed
JasonPhang98 wants to merge 1 commit into
SigmaHQ:masterfrom
JasonPhang98:macos-security-keychain-password-retrieval
Closed

Add macOS Keychain password retrieval detection#6181
JasonPhang98 wants to merge 1 commit into
SigmaHQ:masterfrom
JasonPhang98:macos-security-keychain-password-retrieval

Conversation

@JasonPhang98

Copy link
Copy Markdown
Contributor

Summary of the Pull Request

Adds a macOS process creation rule to detect password retrieval from Keychain generic and internet password items using the built-in security utility with the -w or -g options.

Changelog

new: Keychain Password Retrieval Via Security Command

@github-actions github-actions Bot added Rules Review Needed The PR requires review MacOS Pull request add/update macos related rules labels Jul 27, 2026

@swachchhanda000 swachchhanda000 left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It's kinda related to this existing PR #5848

@nasbench

Copy link
Copy Markdown
Member

Closing this. @JasonPhang98 please add comments as a review to the other PR

@nasbench nasbench closed this Jul 27, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

MacOS Pull request add/update macos related rules Review Needed The PR requires review Rules Work In Progress Some changes are needed

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants