<group name="linux,syscheck,purple-team-fim,">

  <rule id="100410" level="10">

    <if_group>syscheck</if_group>

    <field name="file" type="pcre2">^/etc/cron</field>

    <description>Cron file created or modified: $(file) - possible scheduled-task persistence</description>

    <mitre>

      <id>T1053.003</id>

    </mitre>

  </rule>

  <rule id="100411" level="10">

    <if_group>syscheck</if_group>

    <field name="file" type="pcre2">^/etc/systemd/system/.+\.service</field>

    <description>Systemd unit created or modified: $(file) - possible service persistence</description>

    <mitre>

      <id>T1543.002</id>

    </mitre>

  </rule>

  <rule id="100412" level="12">

    <if_group>syscheck</if_group>

    <field name="file" type="pcre2">\.ssh/authorized_keys$</field>

    <description>SSH authorized_keys modified: $(file) - possible persistence via account manipulation</description>

    <mitre>

      <id>T1098.004</id>

    </mitre>

  </rule>

  <rule id="100413" level="10">

    <if_group>syscheck</if_group>

    <field name="file" type="pcre2">^/usr/local/bin/</field>

    <description>Binary placed in /usr/local/bin: $(file) - possible persistence or tooling drop</description>

    <mitre>

      <id>T1543</id>

    </mitre>

  </rule>

</group>