AN0156
Analytic 0156
macOS
Detects suspicious memory access attempts targeting the `securityd` process. Observes tools invoking process memory read operations (e.g., ptrace, task_for_pid) against `securityd`. Correlates with anomalous parent process lineage, root privilege escalation, or repeated unauthorized attempts.
macos:unifiedlog
ptrace or task_for_pid
macos:unifiedlog
execution of memory inspection tools (lldb, gdb, osqueryi)
[AllowedDebuggers]
List of authorized debugging tools permitted in dev/test environments
[TimeWindow]
Correlation period between memory inspection and Keychain API access
[PrivilegedUsers]
Expected set of admin accounts with legitimate debugging permissions
AN0157
Analytic 0157
Linux
Detects adversaries attempting to attach debuggers or memory dump utilities to credential storage daemons analogous to macOS `securityd`. Observes ptrace syscalls, /proc/<pid>/mem access, or gcore dumps against sensitive processes. Correlates anomalies with privilege escalation or credential dumping attempts.
auditd:SYSCALL
ptrace attach
auditd:FILE
/proc/*/mem read attempt
auditd:EXECVE
gcore, gdb, strings, hexdump execution
[MonitoredProcesses]
List of credential storage daemons (e.g., securityd, gnome-keyring, kwallet) monitored for memory access attempts
[CorrelationDepth]
Defines how many chained events (process execution + syscall + file read) to correlate before raising an alert
[PrivilegeContext]
Expected user/group context for processes allowed to access protected memory