diff --git a/atomics/T1016/T1016.yaml b/atomics/T1016/T1016.yaml
index bb975ee2..5275494a 100644
--- a/atomics/T1016/T1016.yaml
+++ b/atomics/T1016/T1016.yaml
@@ -191,7 +191,7 @@ atomic_tests:
   - macos
   executor:
     command: |
-      defaults read /Library/Preferences/com.apple.alf || defaults read /usr/libexec/ApplicationFirewall/com.apple.alf
+      defaults read /usr/libexec/ApplicationFirewall/com.apple.alf || defaults read /Library/Preferences/com.apple.alf
       /usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate
     name: sh
 - name: DNS Server Discovery Using nslookup