LoFP
/
t1562.003
t1562.003
Title
Tags
legitimate administrative activities
t1059
t1059.012
t1082
t1098
t1497
t1497.001
t1562
t1562.001
t1562.003
macos
linux
gcp
sigma
limited false positives in most environments, however tune as needed.
t1059
t1070
t1110
t1499
t1529
t1562
t1562.001
t1562.003
t1562.004
T1601.001
T1673
infrastructure
splunk