CmdID

CmdID / Commands

defaults

Read and write macOS user configuration for applications. tldr-pages

On macOS 2 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

macOS

from tldr-pages, CC BY 4.0

Read system defaults for an application option

defaults read "application" "option"Identify

Read default values for an application option

defaults read -app "application" "option"Identify

Search for a keyword in domain names, keys, and values

defaults find "keyword"Identify

Write the default value of an application option

defaults write "application" "option" -type valueIdentify

Speed up Mission Control animations

defaults write com.apple.Dock expose-animation-duration -float 0.1Identify

Delete all defaults of an application

defaults delete "application"Identify

What detects it

Sigma process creation rules that name defaults
lowLocal System Accounts Discovery - MacOsAlejandro Ortuno, oscd.community
informationalSystem Network Discovery - macOSremotephone, oscd.community