cortado/rtas/plist_creation.py [22:30]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    platforms=[OSType.MACOS],
    endpoint_rules=[
        RuleMetadata(
            id="901f0c30-a7c5-40a5-80e3-a50c6714432f", name="Suspicious Property List File Creation or Modification"
        )
    ],
    techniques=["T1547", "T1543"],
)
def main():
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



cortado/rtas/plistbuddy_file_modification.py [16:24]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    platforms=[OSType.MACOS],
    endpoint_rules=[
        RuleMetadata(
            id="901f0c30-a7c5-40a5-80e3-a50c6714432f", name="Suspicious Property List File Creation or Modification"
        )
    ],
    techniques=["T1547", "T1543"],
)
def main():
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -