macOS Securityd Memory Dumped for Credentials

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•2

This rule detects attempts to dump memory from the 'securityd' process on macOS systems, specifically looking for the string 'securityd' and 'ptrace' in TCP traffic on port 22. This activity is indicative of credential access attempts, as 'securityd' handles sensitive security information.