Credentials from Password Stores - Keychain
Detects attempts to extract credentials from macOS Keychain using the 'security' command-line utility. This rule specifically looks for the use of 'security' with arguments like 'find-certificate', 'export', 'dump-keychain', or 'login-keychain', which are commonly used to access or dump Keychain contents.
Sigma
