CrashStealer Local Password Validation via dscl -authonly

Duo Tech@duotech

•updated Jul 14, 2026•2•0•5

Detects execution of the macOS 'dscl' utility using the '-authonly' flag. This command is used to authenticate a user against a directory service without creating a session, which can be indicative of brute-force attempts or credential validation by unauthorized processes.