macOS Python stealer harvesting keychain, browser credentials, and shell history
This rule detects potential credential harvesting and sensitive data collection activities on macOS by monitoring for access to keychain databases, browser data files (cookies, logins), and shell history files. It looks for both direct file access and the use of the 'security' utility to dump keychain information.
Microsoft Sentinel (KQL)
