macOS Keychain Data Access

Tim Peck@timpeck

•updated Aug 29, 2025•2•2•63

Detects attempts to list or dump macOS Keychain data using the built-in 'security' utility. This activity can be indicative of credential theft attempts by an adversary.