macOS Keychain Dumped via Remote SSH

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•2

This rule detects attempts to dump the macOS Keychain via a remote SSH connection. It specifically looks for the string "security dump-keychain" within TCP traffic on port 22 (SSH). This command is used to extract credentials and other sensitive information stored in the macOS Keychain.