Programmatic login keychain unlock via 'security unlock-keychain'

Duo Tech@duotech

•updated Jul 14, 2026•1•0•2

Detects the use of the security command-line tool with the 'unlock-keychain' argument and the '-p' flag, which indicates an attempt to programmatically unlock a keychain, potentially using a supplied password.