LoFP / t1690

t1690

Title	Tags
legitimate administrative activities	t1059 t1059.012 t1082 t1098 t1497 t1497.001 t1685 t1690 macos gcp linux sigma
limited false positives in most environments, however tune as needed.	t1059 t1070 t1110 t1499 t1529 T1601.001 T1673 t1685 t1686 t1690 infrastructure splunk