plutil

View, convert, validate, or edit property list ("plist") files. tldr-pages

On macOS 3 Sigma rules name it

macOS

Display the contents of one or more plist files in human-readable format

plutil -p file1.plist file2.plist ...Identify

Convert one or more plist files to XML format, overwriting the original files in-place

plutil -convert xml1 file1.plist file2.plist ...Identify

Convert one or more plist files to binary format, overwriting the original files in-place

plutil -convert binary1 file1.plist file2.plist ...Identify

Convert a plist file to a different format, writing to a new file

plutil -convert xml1 path/to/file.plist -o path/to/new_file.plistIdentify

Convert a plist file to a different format, writing to stdout

plutil -convert xml1 path/to/file.plist -o -Identify

Sigma process creation rules that name plutil

mediumPotential XCSSET Malware InfectionTim Rauch (rule), Elastic (idea)