ATT&CK technique
View on MITRE ATT&CK →
T1647
Plist File Modification
Defense Impairment
6 detections found
Detection rules
| Source | Rule | Status | Updated |
|---|---|---|---|
| elastic | SoftwareUpdate Preferences Modification | production | 2026-09-18 |
| elastic | Modification of Safari Settings via Defaults Command | production | 2026-09-18 |
| elastic | Suspicious Apple Mail Rule Plist Modification | production | 2026-09-18 |
| elastic | Creation of Hidden Login Item via Apple Script | production | 2026-09-18 |
| elastic | Potential Persistence via Login Hook | production | 2026-09-18 |
| splunk | MacOS plutil | production | 2026-05-13 |