Techniques › T1555.005 › AN1643
AN1643 Analytic 1643
macOS · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Detection of password manager database access (1Password .opvault, LastPass caches, KeePass .kdbx) outside expected parent processes. Identifies memory scraping attempts via suspicious API calls or tools attaching to password manager processes.</p>
- Detects
- T1555.005 Password Managers
- Part of
- DET0597 Detect Unauthorized Access to Password Managers
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| macos:unifiedlog | security OR injection attempts into 1Password OR LastPass | DC0032 Process Creation |
| macos:unifiedlog | *.opvault OR *.ldb OR *.kdbx | DC0055 File Access |
| macos:osquery | unexpected memory inspection | DC0035 Process Access |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
VaultFileExtensions | Password manager file extensions (.opvault, .kdbx, .ldb) to monitor for anomalous access. |
ParentProcessWhitelist | Expected parent processes that normally access password manager files, for filtering false positives. |