macOS PamStealer keychain unlock + ACL modification chain via security binary

Arnold Chan@slaz

•updated Sep 25, 2026•0•0•0

This rule detects the use of the macOS 'security' utility to unlock the login keychain and modify its access-control list, a technique observed in PamStealer malware to facilitate subsequent unauthorized access to the keychain database.