macOS Login Password Validated via dscl -authonly
Detects use of dscl -authonly to programmatically validate a user-supplied password against the local directory, a technique used by infostealers like AmnesiaStealer to confirm the captured credential is correct before using it to unlock the login keychain and escalate access to protected data.
CQL
