BIOC
Informational
✕
Keychain Import Item
An item was imported from the Keychain.
- Module:
- Platform Analytics
- Agent event type:
- Process execution
- Category:
- Credential Access
- Status:
- Enabled
ATT&CK tactics: Credential Access (TA0006)
ATT&CK techniques: Credentials from Password Stores: Keychain (T1555.001)
Indicator:
Process action type = execution AND target process cmd =~ .*import.*[.]pem.*(-k)?.* AND target process name = security
Preventable: yes