ClickLock macOS Keychain Credential Harvesting via Security Utility

Kaung Khant Ko@kaungkhantko

•updated Aug 25, 2026•5•0•8

This rule detects the use of the 'security' command-line utility on macOS to access or dump contents from the login keychain, specifically targeting the 'login.keychain-db' file or attempting to retrieve generic passwords. This behavior is indicative of credential access attempts where an adversary is trying to extract sensitive information, such as passwords or keys, stored within the macOS Keychain.