t1497 | LoFP

t1497

Title	Tags
administrator may use choice.exe to allow user to choose from and indexes of choices from a batch script.	t1497 T1497.003 endpoint splunk
administrator or network operator may execute this command. please update the filter macros to remove false positives.	t1497 T1497.003 endpoint splunk
legitimate administrative activities	t1082 t1098 t1497 t1497.001 t1562 t1562.001 t1562.003 gcp macos linux sigma