LoFP
/
t1546.004
t1546.004
Title
Tags
admin or user activity are expected to generate some false positives
t1546
t1546.004
linux
sigma
administrator or network operator can create file in profile.d folders for automation purposes. please update the filter macros to remove false positives.
t1546.004
endpoint
splunk
administrator or network operator can use this application for automation purposes. please update the filter macros to remove false positives.
t1016
t1030
t1033
t1053.002
t1053.003
t1083
t1136.001
t1140
t1222.002
t1485
t1489
t1546.004
t1547.006
t1552.004
t1555.005
t1562.004
T1562.012
t1569.002
t1574.006
endpoint
splunk
administrator or network operator can use this commandline for automation purposes. please update the filter macros to remove false positives.
t1053.002
t1053.003
T1053.006
T1098.004
t1546.004
endpoint
splunk