From 1bffb74009d5a040224d21f74729227ee47c8beb Mon Sep 17 00:00:00 2001
From: tccontre <26181693+tccontre@users.noreply.github.com>
Date: Tue, 11 Jan 2022 12:03:24 +0100
Subject: [PATCH] Update
 linux_possible_append_command_to_profile_config_file.yml

---
 ...inux_possible_append_command_to_profile_config_file.yml | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/detections/endpoint/linux_possible_append_command_to_profile_config_file.yml b/detections/endpoint/linux_possible_append_command_to_profile_config_file.yml
index 97067aadd9..bad838f9b5 100644
--- a/detections/endpoint/linux_possible_append_command_to_profile_config_file.yml
+++ b/detections/endpoint/linux_possible_append_command_to_profile_config_file.yml
@@ -6,9 +6,9 @@ author: Teoderick Contreras, Splunk
 type: Anomaly
 datamodel:
 - Endpoint
-description: This analytic looks for suspicious command lines that are possibly used to modify profile files to automatically execute scripts/files by shell upon boot of the machine. 
+description: This analytic looks for suspicious command-lines that can be possibly used to modify user profile files to automatically execute scripts/executables by shell upon reboot of the machine. 
   This technique is commonly abused by adversaries, malware and red teamers as persistence mechanism to the targeted or compromised host.
-  This Anomaly detection is a good indicator that someone wants to run code after boot up which can be done also by the administrator or network operator for 
+  This Anomaly detection is a good indicator that someone wants to run code after reboot which can be done also by the administrator or network operator for 
   automation purposes.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes 
   where Processes.process = "*echo*" AND Processes.process IN("*~/.bashrc", "*~/.bash_profile", "*/etc/profile", "~/.bash_login", "*~/.profile", "~/.bash_logout")
@@ -57,6 +57,7 @@ tags:
   context:
   - source:endpoint
   - stage:Privilege Escalation Persistence
+  - stage:Persistence
   message: a commandline $process$ that may modify profile files in $dest$
   observable:
   - name: dest
@@ -68,4 +69,4 @@ tags:
   cis20:
   - CIS 3
   - CIS 5
-  - CIS 16
\ No newline at end of file
+  - CIS 16