Local account password validation via dscl -authonly
Detects the use of the 'dscl' utility on macOS with the '-authonly' flag. This command is often used by adversaries or for unauthorized scripts to verify credentials against the local directory service without requiring a full login session, which is a common indicator of credential testing or brute-force attempts.
Microsoft Sentinel (KQL)
