LoFP / t1569.001

t1569.001

Title	Tags
legitimate administration activities is expected to trigger false positives. investigate the command line being passed to determine if the service or launch agent are suspicious.	t1543 t1543.001 t1543.004 t1569 t1569.001 macos sigma