LoFP LoFP / t1074

t1074

TitleTags
administrators may transfer file ownership during employee leave or absence to ensure continued operations by a new or existing employee.
generally used to copy configs or ios images
if known behavior is causing false positives, it can be exempted from the rule.
traffic mirroring may be done by a system or network administrator. verify whether the user identity, user agent, and/or hostname should be making changes in your environment. traffic mirroring from unfamiliar users or hosts should be investigated. if known behavior is causing false positives, it can be exempted from the rule.