What MITRE ATT&CK T1555.002: Securityd Memory (Enterprise Tactic TA0006 - Credential Access) requires
MITRE ATT&CK T1555.002 (Securityd Memory) is an Enterprise Credential Access sub-technique of T1555 (Credentials from Password Stores). An adversary with root access may gather credentials by reading securityd's memory. securityd is a service/daemon responsible for implementing security protocols such as encryption and authorization. A privileged adversary may be able to scan through securityd's memory to find the correct sequence of keys to decrypt the user's logon keychain. This may provide the adversary with various plaintext passwords, such as those for users, WiFi, mail, browsers, certificates, secure notes, etc. Affected platforms: Linux, macOS. The Center for Threat-Informed Defense maps this technique to NIST SP 800-53 Rev 5 controls AC-03, AC-06, AC-20, CA-07, CM-03, IA-05, SI-02, SI-04.
Pillar: Cybersecurity · Authority: MITRE Corporation · Version: 1.0.0 · Last updated:
Primary source: https://attack.mitre.org/techniques/T1555/002/
SHA-256 integrity: 608b8eed136149d5a010c8bdf1ceabacf55d514a200d4f455ba3c9d49a721663
Primary Citations — 6 traced to source
- MITRE ATT&CK Technique T1555.002: Securityd Memory (https://attack.mitre.org/techniques/T1555/002/)
- MITRE ATT&CK Tactic TA0006: Credential Access (https://attack.mitre.org/tactics/TA0006/)
+ 4 more citations (full bibliography, deterministic workflow, actionable schema and crosswalks) included in the vault unlock — $0.01 via Skyfire / L402 / Direct Base USDC.
Access
- Discovery (free): /api/v1/nodes/mitre-attack-t1555-002-securityd-memory.json — 6-field metadata
- Vault (full node): /api/v1/vault/nodes/mitre-attack-t1555-002-securityd-memory.json — full 13-key payload, $0.01 USDC (L402/Skyfire/Direct Base)
- Canonical URL: https://bidda.com/intelligence/mitre-attack-t1555-002-securityd-memory
- Back to registry: Browse all 10,085 compliance nodes