Add test for keychain dump

redcanaryco · Nov 27, 2023 · 78d3c30 · 78d3c30
1 parent 9defc5c
commit 78d3c30
Showing 1 changed file with 13 additions and 0 deletions.
diff --git a/atomics/T1555.001/T1555.001.yaml b/atomics/T1555.001/T1555.001.yaml
@@ -28,3 +28,16 @@ atomic_tests:
       security find-certificate -a -p > #{cert_export}
       security import #{cert_export} -k
     name: sh
+
+- name: Keychain Dump
+  auto_generated_guid: 
+  description: |-
+    This command will dump keychain credential information from login.keychain. 
+    Source: https://www.loobins.io/binaries/security/
+  supported_platforms:
+  - macos
+  executor:
+    command: sudo security dump-keychain -d login.keychain
+    cleanup_command: 
+    name: sh
+    elevation_required: true