From 80637a218399e956de25a13ddd2085d6ec232cca Mon Sep 17 00:00:00 2001
From: Hare Sudhan <code@0x6c.dev>
Date: Fri, 16 May 2025 18:43:19 -0400
Subject: [PATCH] fix T1016

---
 atomics/T1016/T1016.yaml | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/atomics/T1016/T1016.yaml b/atomics/T1016/T1016.yaml
index 1cbcbbbd..bb975ee2 100644
--- a/atomics/T1016/T1016.yaml
+++ b/atomics/T1016/T1016.yaml
@@ -191,10 +191,9 @@ atomic_tests:
   - macos
   executor:
     command: |
-      sudo defaults read /Library/Preferences/com.apple.alf
-      sudo /usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate
-    name: bash
-    elevation_required: true
+      defaults read /Library/Preferences/com.apple.alf || defaults read /usr/libexec/ApplicationFirewall/com.apple.alf
+      /usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate
+    name: sh
 - name: DNS Server Discovery Using nslookup
   auto_generated_guid: 34557863-344a-468f-808b-a1bfb89b4fa9
   description: |