Meow RAT macOS Keychain Credential Harvesting via security CLI and osascript
This rule detects suspicious attempts to access macOS Keychain credentials using the 'security' command-line utility or 'osascript'. It specifically looks for 'security' commands attempting to find generic or internet passwords, unlock keychains, or target browser-specific safe storage keys (Chrome, Brave, Microsoft Edge). It also flags 'osascript' processes accessing Keychain paths. The rule excludes legitimate system and browser processes to reduce false positives.
Microsoft Sentinel (KQL)
