Amos Stealer macOS Keychain Access via osascript and security utility

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•4

This rule detects suspicious access to macOS Keychain files or the use of the 'security' utility to manipulate keychains. It specifically looks for 'osascript' accessing keychain-related paths, the 'security' utility using commands like 'unlock-keychain' or 'find-generic-password', or common shell utilities ('cp', 'cat', 'sh', 'bash', 'zsh') accessing keychain database files. This activity is often indicative of credential access attempts.