LoFP / T1601.001

T1601.001

Title	Tags
limited false positives in most environments, however tune as needed.	t1059 t1070 t1110 t1499 t1529 t1562 t1562.001 t1562.003 t1562.004 T1601.001 T1673 infrastructure splunk