Update linux_possible_append_command_to_profile_config_file.yml

detections/endpoint/linux_possible_append_command_to_profile_config_file.yml

@@ -6,9 +6,9 @@ author: Teoderick Contreras, Splunk
 type: Anomaly
 datamodel:
 - Endpoint
-description: This analytic looks for suspicious command lines that are possibly used to modify profile files to automatically execute scripts/files by shell upon boot of the machine. 
+description: This analytic looks for suspicious command-lines that can be possibly used to modify user profile files to automatically execute scripts/executables by shell upon reboot of the machine. 
   This technique is commonly abused by adversaries, malware and red teamers as persistence mechanism to the targeted or compromised host.
-  This Anomaly detection is a good indicator that someone wants to run code after boot up which can be done also by the administrator or network operator for 
+  This Anomaly detection is a good indicator that someone wants to run code after reboot which can be done also by the administrator or network operator for 
   automation purposes.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes 
   where Processes.process = "*echo*" AND Processes.process IN("*~/.bashrc", "*~/.bash_profile", "*/etc/profile", "~/.bash_login", "*~/.profile", "~/.bash_logout")
@@ -57,6 +57,7 @@ tags:
   context:
   - source:endpoint
   - stage:Privilege Escalation Persistence
+  - stage:Persistence
   message: a commandline $process$ that may modify profile files in $dest$
   observable:
   - name: dest
@@ -68,4 +69,4 @@ tags:
   cis20:
   - CIS 3
   - CIS 5
-  - CIS 16
+  - CIS 16