LoFP / T1654

T1654

Title	Tags
system administrators or monitoring tools may legitimately use these utilities to gather logs for troubleshooting or auditing. filter known admin behavior or monitoring solutions as needed.	T1654 endpoint splunk