[New Rule] - Exfiltration preparation of mac Keychains files

[Samirbous]

Description

https://objective-see.com/blog/blog_0x25.html

Required Info

• Eventing Sources:

• Target Operating Systems:

• Platforms

• Target ECS Version: x.x.x
• New fields required in ECS for this?
• Related issues or PRs

Optional Info

• References:

Example Data