Empire/keychaindump_decrypt.py at 08cbd274bef78243d7a8ed6443b8364acd1fc48b · EmpireProject/Empire
Tags
attack-pattern: Applescript - T1059.002 Keychain - T1634.001 Keychain - T1555.001 Keychain - T1579 Powershell - T1059.001 Python - T1059.006 Applescript - T1155 Keychain - T1142 Powershell - T1086
Show in Graph
Common Information
Type Value
UUID 6c89594c-a474-4dbb-9991-ddce72e3c5d3
Fingerprint fa266c7c24a7e7dc
Analysis status DONE
Considered CTI value 0
Text language
Published Jan. 1, 2022, midnight
Added to db Sept. 26, 2022, 9:31 a.m.
Last updated Nov. 12, 2024, 2:02 a.m.
Headline UNKNOWN
Title Empire/keychaindump_decrypt.py at 08cbd274bef78243d7a8ed6443b8364acd1fc48b · EmpireProject/Empire
Detected Hints/Tags/Attributes 14/1/5
Source URLs
Redirection Url
Details Source https://github.com/EmpireProject/Empire/blob/08cbd274bef78243d7a8ed6443b8364acd1fc48b/lib/modules/python/collection/osx/keychaindump_decrypt.py
URL Provider
Details Provider Source level domain
Details github.com github.com
Attributes
Details Type #Events CTI Value
Details Domain 6 
self.info
Details File 1 
keychaindump_decrypt.py
Details File 8 
self.inf
Details File 4 
self.opt
Details sha1 2 
08cbd274bef78243d7a8ed6443b8364acd1fc48b