LoFP / t1543.001

t1543.001

Title	Tags
some legitimate applications may use plistbuddy to create or modify property lists and possibly generate false positives. review the property list being modified or created to confirm.	t1543 t1543.001 endpoint splunk