LoFP / t1562.003

t1562.003

Title	Tags
legitimate administrative activities	t1059 t1059.012 t1082 t1098 t1497 t1497.001 t1562 t1562.001 t1562.003 macos linux gcp sigma
limited false positives in most environments, however tune as needed.	t1059 t1070 t1110 t1499 t1529 t1562 t1562.001 t1562.003 t1562.004 T1601.001 T1673 infrastructure splunk