LoFP / T1688

T1688

Title	Tags
mounting the efi volume can be part of normal system updates or legitimate maintenance tasks. monitor for unusual timing or context to reduce false alerts.	t1204.002 t1542 T1688 endpoint splunk