Menu
Adversaries may collect keychain data from an iOS device to acquire credentials.
The review-first prompt is selected by default. You can switch to a direct command or download a local copy.
Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
A direct command skips the review prompt. Inspect the source before running it.
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill t1634-001-keychainThe command stays on one line. Scroll horizontally to inspect it before copying.
Prefer a local copy? Download the files currently available to SkillsMP.
macOS post-exploitation for credential harvesting, DTrace monitoring, TCC bypass, and stealth operations via native tools
Windows userland post-exploitation for credential harvesting, monitoring, AMSI/ETW bypass, and stealth operations
Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence
Based on SOC occupation classification
Showing SKILL.md
| name | T1634.001_keychain |
| description | Adversaries may collect keychain data from an iOS device to acquire credentials. |
| category | authentication |
| version | 18.1 |
| author | cyberstrike-official |
| tags | ["mitre-attack","mobile","t1634.001","credential-access","ios","sub-technique"] |
| technique_id | T1634.001 |
| tactic | credential-access |
| all_tactics | ["credential-access"] |
| platforms | ["iOS"] |
| mitre_url | https://attack.mitre.org/techniques/T1634/001 |
| tech_stack | ["ios"] |
| cwe_ids | ["CWE-522"] |
| chains_with | ["T1634"] |
| prerequisites | ["T1634"] |
| severity_boost | {"T1634":"Chain with T1634 for deeper attack path"} |
Sub-technique of: T1634
Adversaries may collect keychain data from an iOS device to acquire credentials. Keychains are the built-in way for iOS to keep track of users' passwords and credentials for many services and features such as Wi-Fi passwords, websites, secure notes, certificates, private keys, and VPN credentials.
On the device, the keychain database is stored outside of application sandboxes to prevent unauthorized access to the raw data. Standard iOS APIs allow applications access to their own keychain contained within the database. By utilizing a privilege escalation exploit or existing root access, adversaries can access the entire encrypted database.
Platforms: iOS
Determine if the target mobile environment is susceptible to Keychain by examining the target platforms (iOS).
Review whether mitigations for T1634.001 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
Mobile security products can take appropriate action when jailbroken devices are detected, potentially limiting the adversary’s access to password stores.
Apple regularly provides security updates for known OS vulnerabilities.
Device attestation can often detect jailbroken devices.
| Finding | Severity | Impact |
|---|---|---|
| Keychain technique applicable | High | Credential Access |
| CWE ID |
|---|
| Title |
|---|
| CWE-522 | Insufficiently Protected Credentials |
