System

macOS Login Keychain Database

The macOS login keychain database can contain saved passwords, certificates, keys, and application credentials.

Metadata

id: system.macos-login-keychain
category: system
sensitivity: critical
subcategory: macos-keychain
artifact types: password-store, credential, private-key
tags: macos, keychain

Path Matchers

Path	Kind	Platforms
`$HOME/Library/Keychains/login.keychain-db`	`file`	`macos`

Credential Types

saved-password
private-key

Impact

credential_access

References

System Environment File

System environment files can expose application secrets, API keys, and service connection strings.

Unix passwd File

Unix passwd files reveal local account names, user IDs, home directories, and login shells.

On this page

Metadata Path Matchers Credential Types Impact References