T1647 — Plist File Modification

# T1647 - Plist File Modification

## SOC Recommendation
Investigate Plist File Modification activity in the context of Defense Impairment: confirm scope, affected host/identity, and whether it matches expected administrative behaviour before deciding this is benign.

## D3FEND Mappings
| D3FEND Technique | Relationship | Practical SOC Action |
|---|---|---|
| Network Traffic Analysis | Detect | Monitor for Network Traffic Analysis indicators relevant to this technique. |

## Investigation Steps
1. Review Defender for Endpoint / Defender XDR alerts and timeline for the affected host or identity.
2. Check Sentinel analytics rules and incidents correlated with this technique.
3. Review Entra ID sign-in and audit logs if the technique involves an identity or cloud resource.

## Evidence to Collect
- Host or resource affected
- Account or identity involved
- Timestamp of the activity
- Related process, file, or network artifact
- Any preceding or follow-on alerts

## Response Actions
| Action | Risk | Automation Safe | Approval Required |
|---|---|---|---|
| Contain the affected host or account | Medium | No | Yes |
| Collect and preserve evidence | Low | Yes | No |

## KQL
```kql
DeviceEvents
| where TimeGenerated > ago(24h)
| where ActionType has "<tune to T1647>"
```

## Escalation Criteria
- Plist File Modification activity observed on a privileged account or critical system.
- Activity follows or precedes other suspicious behaviour in the same investigation.
- Automated triage cannot confidently rule out malicious intent.

## False Positive Considerations
- Legitimate administrative or maintenance activity matching this pattern.
- Approved security testing or red team exercise.
- Known benign software producing similar telemetry.

Generated by SOC Response Atlas by Basyrix.

Want to push this directly to Confluence? Upgrade to Basyrix Pro.

• /api/techniques/T1647.json
• /api/recommendations/T1647.json
• /api/d3fend/T1647.json
• /api/mappings/T1647.json
• /api/confluence/T1647.md

Example curl:

curl https://atlas.basyrix.com/api/recommendations/T1647.json

Response:

{
  "technique_id": "T1647",
  "name": "Plist File Modification",
  "priority": "medium",
  "status": "draft",
  "version": "0.1.0",
  "last_reviewed": "2026-07-23",
  "generated_by": "SOC Response Atlas by Basyrix",
  "tactics": [
    "Defense Impairment"
  ],
  "platforms": [
    "macOS"
  ],
  "summary": "Adversaries may modify property list files (plist files) to enable other malicious activity, while also potentially evading and bypassing system defenses. macOS applications use plist files, such as the <code>info.plist</code> file, to store properties and configuration settings that inform the operating system how to handle the application at runtime. Plist files are structured metadata in key-value pairs formatted in XML based on Apple's Core Foundation DTD...",
  "soc_recommendation": "Investigate Plist File Modification activity in the context of Defense Impairment: confirm scope, affected host/identity, and whether it matches expected administrative behaviour before deciding this is benign.",
  "d3fend_mappings": [
    {
      "id": "D3-NTA",
      "name": "Network Traffic Analysis",
      "relationship": "detect",
      "practical_action": "Monitor for Network Traffic Analysis indicators relevant to this technique.",
      "tooling": [
        "Sentinel",
        "Defender for Endpoint"
      ]
    }
  ],
  "investigation_steps": {
    "microsoft": [
      "Review Defender for Endpoint / Defender XDR alerts and timeline for the affected host or identity.",
      "Check Sentinel analytics rules and incidents correlated with this technique.",
      "Review Entra ID sign-in and audit logs if the technique involves an identity or cloud resource."
    ],
    "generic": [
      "Confirm whether the observed plist file modification activity matches expected administrative or application behaviour.",
      "Identify the host, account, or resource where the activity occurred and its business criticality.",
      "Check for related alerts before and after this activity to reconstruct the broader intrusion timeline.",
      "Real detection reference: \"SoftwareUpdate Preferences Modification\" -- Identifies changes to the SoftwareUpdate preferences using the built-in defaults command. Adversaries may abuse this in an attempt to disable security updates."
    ]
  },
  "evidence_to_collect": [
    "Host or resource affected",
    "Account or identity involved",
    "Timestamp of the activity",
    "Related process, file, or network artifact",
    "Any preceding or follow-on alerts"
  ],
  "response_actions": [
    {
      "name": "Contain the affected host or account",
      "category": "Containment",
      "risk": "Medium",
      "automation_safe": false,
      "approval_required": true,
      "tool": "Defender for Endpoint / Entra ID",
      "notes": "Requires approval -- confirm malicious intent before isolating a host or disabling an account."
    },
    {
      "name": "Collect and preserve evidence",
      "category": "Investigation",
      "risk": "Low",
      "automation_safe": true,
      "approval_required": false,
      "tool": "Defender for Endpoint",
      "notes": "Safe -- read-only evidence collection."
    }
  ],
  "queries": {
    "kql": [
      {
        "name": "Starting point for T1647",
        "description": "Generic starting query -- tune to the specific data source relevant to this technique.",
        "query": "DeviceEvents\n| where TimeGenerated > ago(24h)\n| where ActionType has \"<tune to T1647>\""
      }
    ],
    "spl": [],
    "esql": [
      {
        "name": "f683dcdf-a018-4801-b066-193d4ae6c8e5 — SoftwareUpdate Preferences Modification",
        "description": "(EQL) Identifies changes to the SoftwareUpdate preferences using the built-in defaults command. Adversaries may abuse this in an attempt to disable security updates. (Source: Elastic's official detection-rules repository (Elastic License v2).)",
        "query": "process where host.os.type == \"macos\" and event.type in (\"start\", \"process_started\") and\n process.name == \"defaults\" and\n process.args like \"write\" and process.args like \"-bool\" and process.args like~ (\"com.apple.SoftwareUpdate\", \"/Library/Preferences/com.apple.SoftwareUpdate.plist\") and not process.args like (\"TRUE\", \"true\")"
      },
      {
        "name": "6482255d-f468-45ea-a5b3-d3a7de1331ae — Modification of Safari Settings via Defaults Command",
        "description": "(EQL) Identifies changes to the Safari configuration using the built-in defaults command. Adversaries may attempt to enable or disable certain Safari settings, such as enabling JavaScript from Apple Events to ease in the hijacking of the users browser. (Source: Elastic's official detection-rules repository (Elastic License v2).)",
        "query": "process where host.os.type == \"macos\" and event.type in (\"start\", \"process_started\") and\n  process.name == \"defaults\" and process.args like~ \"write\" and\n  process.command_line like~ \"*com.apple.Safari*\" and \n  process.command_line like~ (\"*IncludeDevelopMenu*\", \"*JavaScript*\")"
      }
    ]
  },
  "automation": {
    "safe": [
      "Add recommendation as Sentinel incident comment.",
      "Run enrichment queries.",
      "Create ServiceNow SecOps task."
    ],
    "approval_required": [
      "Contain or disable the affected host/account.",
      "Any change to production configuration."
    ]
  },
  "escalation_criteria": [
    "Plist File Modification activity observed on a privileged account or critical system.",
    "Activity follows or precedes other suspicious behaviour in the same investigation.",
    "Automated triage cannot confidently rule out malicious intent."
  ],
  "false_positive_considerations": [
    "Legitimate administrative or maintenance activity matching this pattern.",
    "Approved security testing or red team exercise.",
    "Known benign software producing similar telemetry."
  ],
  "confluence": {
    "title": "T1647 - Plist File Modification Response Guidance",
    "labels": [
      "mitre",
      "attack",
      "d3fend",
      "secops",
      "basyrix"
    ],
    "sections": [
      "summary",
      "d3fend_mappings",
      "investigation_steps",
      "response_actions",
      "queries",
      "automation",
      "escalation_criteria",
      "false_positive_considerations"
    ]
  }
}