[Detection summary]: Find passphrase for macOS diskutil
Weltraumschaf opened this issue · 3 comments
Weltraumschaf commented
Description
diskutil apfs unlockVolume /dev/XXX -passphrase YYY
kaplanelad commented
Hey @Weltraumschaf thank you for this issue.
Do you want to catch the YYY value like in your example?
Weltraumschaf commented
Yes, YYY is the secret passphrase to decrypt the encrypted APFS disk.
kaplanelad commented
@Weltraumschaf, thanks for this issue.
The pattern was added to version 0.4.5
If you have any more patterns to detect, feel free to open a new issue or open a new PR for that (see #60).