From e6dcc82562c08ea6b2e484a09bd3071fa06b8cec Mon Sep 17 00:00:00 2001
From: Lou Stella <ljstella@gmail.com>
Date: Thu, 26 May 2022 12:52:42 -0500
Subject: [PATCH] Updating tactic

---
 detections/endpoint/macos_plutil.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/macos_plutil.yml b/detections/endpoint/macos_plutil.yml
index 3401678938..a847e5eb7d 100644
--- a/detections/endpoint/macos_plutil.yml
+++ b/detections/endpoint/macos_plutil.yml
@@ -39,7 +39,7 @@ tags:
   - Actions on Objectives
   message: plutil are executed on $host$ from $user$
   mitre_attack_id:
-  - T1547.011
+  - T1647
   nist:
   - DE.CM
   observable: