Miolab Stealer Credential Validation via dscl
Detects the execution of the native macOS dscl utility with the -authonly flag. This technique is used by malware, such as Miolab Stealer, to silently validate phished user credentials captured via fake authentication prompts before escalating privileges or exfiltrating data.
Sigma
