Security CLI utility accessing login.keychain-db credential store

Duo Tech@duotech

•updated Jul 6, 2026•2•0•3

Detects the use of the 'security' command-line utility to interact with the 'login.keychain-db' file on macOS, which is a common technique used by adversaries to dump credentials.