macOS Plist File Creation or Modification
Detects the creation or modification of .plist files on macOS systems. This activity can be indicative of various malicious behaviors, particularly those related to persistence or privilege escalation, as .plist files are often used to configure application settings, launch agents, or other system behaviors.
Microsoft Sentinel (KQL)
