value:  macOs malware may try to use the ‘plist’ command to manipulate keys in property list (plist) files to elevate privileges or establish persistence. 
name: Boot or Logon Autostart Execution: Plist Modification