Tool

github.com/specterops/presentations/raw/master/Leo%20Pitt/Hey_Im_Still_in_Here_Modern_macOS_Persistence_SO-CON2020.pdf

https://github.com/specterops/presentations/raw/master/Leo%20Pitt/Hey_Im_Still_in_Here_Modern_macOS_Persistence_SO-CON2020.pdf

Published on: github.com

ATT&CK techniques those detections carry

T1543Create or Modify System Process
T1547Boot or Logon Autostart Execution
T1547.009Shortcut Modification

Open the original

2 published detections cite this

Citing it, not covering it: each of these was written with this as evidence, and carries the source it came from and the licence it was published under.

Detections citing this reference
Detection	Severity	Source	Published	Licence
Finder Sync Plugin Registered and Enabled	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Persistence via Docker Shortcut Modification	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0

Showing 2 of 2

Filter in the catalogue