https://www.elastic.co/docs/reference/security/prebuilt-rules/rules/macos/persistence_docker_shortcuts_plist_modification
Persistence via Docker Shortcut Modification | Prebuilt detection rules reference
An adversary can establish persistence by modifying an existing macOS dock property list in order to execute a malicious application instead of the intended...
shortcut modificationdetection rulespersistenceviadocker