From fbf3b57ef005ff29bd9586b2f0a5c90f794a4344 Mon Sep 17 00:00:00 2001
From: Hare Sudhan <code@0x6c.dev>
Date: Fri, 16 May 2025 20:38:10 -0400
Subject: [PATCH] fix T1016

---
 atomics/T1016/T1016.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/atomics/T1016/T1016.yaml b/atomics/T1016/T1016.yaml
index bb975ee26..5275494ad 100644
--- a/atomics/T1016/T1016.yaml
+++ b/atomics/T1016/T1016.yaml
@@ -191,7 +191,7 @@ atomic_tests:
   - macos
   executor:
     command: |
-      defaults read /Library/Preferences/com.apple.alf || defaults read /usr/libexec/ApplicationFirewall/com.apple.alf
+      defaults read /usr/libexec/ApplicationFirewall/com.apple.alf || defaults read /Library/Preferences/com.apple.alf
       /usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate
     name: sh
 - name: DNS Server Discovery Using nslookup