LoFP / T1647

T1647

Title	Tags
administrators using plutil to change plist files.	T1647 endpoint splunk
authorized softwareupdate settings changes	t1562 T1647 macos elastic