LoFP / T1589.001

T1589.001

Title	Tags
little to no false positives in most environments. tune as needed.	t1014 T1589.001 endpoint splunk
this module can be loaded by a third party application. filter is needed.	t1003 t1056.002 t1219 T1589.001 endpoint splunk