Keychain Credential Files Collected via Archive Utility

[rule]
description = """
Adversaries may collect the keychain storage data from a system to acquire credentials. Keychains are the built-in way
for macOS to keep track of users' passwords and credentials for many services and features such as WiFi passwords,
websites, secure notes and certificates.
"""
id = "150f20b4-6b21-460b-8ae4-339695c1c86c"
license = "Elastic License v2"
name = "Keychain Credential Files Collected via Archive Utility"
os_list = ["macos"]
reference = [
    "https://objective-see.com/blog/blog_0x25.html",
    "https://securelist.com/calisto-trojan-for-macos/86543/",
]
version = "1.0.31"

query = '''
process where event.action == "exec" and process.name in ("zip", "tar") and
  process.command_line like~
    (
      "*/Users/*/Library/Keychains/*",
      "*/Library/Keychains/*",
      "*/Network/Library/Keychains/*",
      "*System.keychain*",
      "*login.keychain-db*",
      "*login.keychain*"
    ) and
    not process.args like~
               ("find-certificate",
                "add-trusted-cert",
                "set-keychain-settings",
                "delete-certificate",
                "/Users/*/Library/Keychains/openvpn.keychain-db",
                "show-keychain-info",
                "lock-keychain",
                "set-key-partition-list",
                "import",
                "find-identity") and
    not process.parent.executable like
      (
        "/Applications/OpenVPN Connect/OpenVPN Connect.app/Contents/MacOS/OpenVPN Connect",
        "/Applications/Microsoft Defender.app/Contents/MacOS/wdavdaemon_enterprise.app/Contents/MacOS/wdavdaemon_enterprise",
        "/opt/jc/bin/jumpcloud-agent"
      ) and
    not process.executable == "/opt/jc/bin/jumpcloud-agent"
'''

min_endpoint_version = "8.10.2"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1555"
name = "Credentials from Password Stores"
reference = "https://attack.mitre.org/techniques/T1555/"
[[threat.technique.subtechnique]]
id = "T1555.001"
name = "Keychain"
reference = "https://attack.mitre.org/techniques/T1555/001/"



[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[internal]
min_endpoint_version = "8.10.2"