CloudKeychainProxy #

 full_path = "/System/Library/Frameworks/Security.framework/CloudKeychainProxy.bundle/CloudKeychainProxy"
 runs_as = "root"

CloudKeychainProxy part of iCloud keychain syncing.