CmdID

CmdID / Commands

security

Administer keychains, keys, certificates, and the Security framework. tldr-pages

On macOS 1 Sigma rule name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

macOS

from tldr-pages, CC BY 4.0

List all available keychains

security list-keychainsIdentify

Delete a specific keychain

security delete-keychain path/to/file.keychainIdentify

Create a keychain

security create-keychain -p password path/to/file.keychainIdentify

Set a certificate to use with a website or service by its common name (fails if several certificates with the same common name exist)

security set-identity-preference -s url -c "common_name" path/to/file.keychainIdentify

Add a certificate from file to a keychain (if -k isn't specified, the default keychain is used)

security add-certificates -k file.keychain path/to/cert_file.pemIdentify

Add a CA certificate to the per-user Trust Settings

security add-trusted-cert -k path/to/user-keychain.keychain-db path/to/ca-cert_file.pemIdentify

Remove a CA certificate from the per-user Trust Settings

security remove-trusted-cert path/to/ca-cert_file.pemIdentify

What detects it

Sigma process creation rules that name security
mediumCredentials from Password Stores - KeychainTim Ismilyaev, oscd.community, Florian Roth (Nextron Systems)