Merge pull request #185 from infosecB/update-default

Update defaults
infosecB · Apr 10, 2024 · 4fc1f18 · 4fc1f18
2 parents b953a50 + a1b6ab4
commit 4fc1f18
Showing 1 changed file with 5 additions and 0 deletions.
diff --git a/LOOBins/defaults.yml b/LOOBins/defaults.yml
@@ -21,6 +21,11 @@ example_use_cases:
   code: sudo defaults write /Library/Preferences/com.apple.loginwindow LoginHook gain_persistence.sh
   tactics:
   - Persistence
+- name: Get Active Directory user info from Jamf Connect
+  description: Retrieve Active Directory user info from Jamf Connect defaults configuration.
+  code: defaults read com.jamf.connect.state
+  tactics:
+  - Discovery
 paths:
 - /usr/bin/defaults
 detections: