Update defaults

- Add Jamf Connect Active Directory user info
infosecB · Apr 10, 2024 · a1b6ab4 · a1b6ab4
1 parent b953a50
commit a1b6ab4
Showing 1 changed file with 5 additions and 0 deletions.
diff --git a/LOOBins/defaults.yml b/LOOBins/defaults.yml
@@ -21,6 +21,11 @@ example_use_cases:
   code: sudo defaults write /Library/Preferences/com.apple.loginwindow LoginHook gain_persistence.sh
   tactics:
   - Persistence
+- name: Get Active Directory user info from Jamf Connect
+  description: Retrieve Active Directory user info from Jamf Connect defaults configuration.
+  code: defaults read com.jamf.connect.state
+  tactics:
+  - Discovery
 paths:
 - /usr/bin/defaults
 detections: