Apple's keychain on macOS is a prime target for real-world adversaries, red teamers, and penetration testers. Because of this, Apple applies a lot of protections to keychain items and access to them. \n\n This talk is a dive into how Apple protects macOS keychain items, how you can enumerate these protections, and how you can bypass some of them. We'll focus on operational use cases, some theory, and code samples. I will release two open-source projects for enumerating and dumping macOS keychain entries along with this talk.