Some credentials live in the memory of a trusted daemon. MITRE ATT&CK technique T1555.002, Securityd Memory, describes an adversary with root access reading the memory of securityd to recover credentials. The tactic is credential access and the platforms listed are Linux and macOS.
How attackers use it
securityd is the service responsible for security protocols such as encryption and authorization. MITRE explains that a privileged adversary may scan its memory to find the sequence of keys needed to decrypt the user's logon keychain. That may expose plaintext passwords for users, WiFi, mail, browsers, certificates and secure notes.
The history matters. In OS X before El Capitan, users with root access could read plaintext keychain passwords of logged-in users, because Apple's keychain implementation caches credentials so users are not prompted repeatedly. securityd takes the user's logon password, encrypts it with PBKDF2, and stores the resulting master key in memory. Apple also uses a set of keys and algorithms to protect the user's password, but MITRE notes that once the master key is found, an adversary only needs to iterate over the other values to reach the final password.
So this is a root level technique that targets how credentials are cached. It is a reminder that "encrypted at rest" does not help once decrypted material sits in memory.
How to detect it
MITRE lists no data sources or mitigations for this page. The prerequisite is root, so the practical detections are about root: unexpected privilege escalation, processes with debug or memory read capability targeting system daemons, and unusual root sessions on Macs. Treat any process reading another process's memory as high priority.
How to reduce the risk
Because no specific mitigation is listed, focus on the preconditions. Keep macOS current, since the behavior MITRE describes is tied to older releases. Limit root and administrator access. Use full disk encryption and require authentication for administrative actions. Rely on endpoint tooling that monitors memory access to system processes.
Quick check
What does an adversary need before this technique works?
Root access. MITRE describes an adversary with root scanning securityd memory for the keys that decrypt the logon keychain.
