All Detections

Mac ClickFix - DSCL Local Credential Validation (T1003)

avatar
Ibrahim Saud@tektrix
updated Jun 21, 2026003

Identifies the AppleScript stealer validating the phished user password locally using the dscl . -authonly command.

Microsoft Sentinel (KQL)