Runtime dlopen of Security.framework to Access Keychain (Anti-Static-Analysis Evasion)
Detects instances where a process located outside of the standard '/System/' or '/usr/' directories loads the 'Security.framework' library. This behavior is suspicious as it may indicate an attempt by an untrusted or malicious binary to hook into or interact with system-level security services, such as keychain or cryptographic APIs.
Cortex XDR
