Meow RAT: Login Keychain Unlock and Chromium Safe Storage Key Extraction
This rule detects attempts to access macOS Keychain credentials or web browser stored credentials using the 'security' command-line utility. It specifically looks for 'security unlock-keychain' and 'security find-generic-password' commands, with the latter also checking for common browser names like Chrome, Brave, and Microsoft Edge. This activity is indicative of an adversary attempting to dump credentials from the system.
Microsoft Sentinel (KQL)
