upstream sync

[r0ot]

• [Rule Tuning] Port Scan Rules ([Rule Tuning] Port Scan Rules elastic/detection-rules#4443)

• [New Hunt] General Kernel Manipulation ([New Hunt] General Kernel Manipulation elastic/detection-rules#4403)

• [New Hunt] General Kernel Manipulation

• Update index.yml

• [New Hunt] Persistence via PolicyKit ([New Hunt] Persistence via PolicyKit elastic/detection-rules#4406)

• [New Hunt] Persistence via PolicyKit

• ++

• [New Hunt] Persistence via Desktop Bus (D-Bus) ([New Hunt] Persistence via Desktop Bus (D-Bus) elastic/detection-rules#4407)

• [Rule Tuning] Remote Execution via File Shares ([Rule Tuning] Remote Execution via File Shares elastic/detection-rules#4448)

• [Rule Tuning] Tighten Up Elastic Defend Indexes - MacOS ([Rule Tuning] Tighten Up Elastic Defend Indexes - MacOS elastic/detection-rules#4447)

• tags (Tuning tags jan 30 (re-PR) #4)

---

Pull Request

Issue link(s):

Summary - What I changed

How To Test

Checklist

• Added a label for the type of pr: bug, enhancement, schema, maintenance, Rule: New, Rule: Deprecation, Rule: Tuning, Hunt: New, or Hunt: Tuning so guidelines can be generated
• Added the meta:rapid-merge label if planning to merge within 24 hours
• Secret and sensitive material has been managed correctly
• Automated testing was updated or added to match the most common scenarios
• Documentation and comments were added for features that require explanation

Contributor checklist

• Have you signed the contributor license agreement?
• Have you followed the contributor guidelines?