Update defense_evasion_file_mod_writable_dir.toml

Aegrah · web-flow · commit c1b604a86a8d · 2025-12-17T16:52:40.000+01:00
diff --git a/rules/linux/defense_evasion_file_mod_writable_dir.toml b/rules/linux/defense_evasion_file_mod_writable_dir.toml
@@ -86,6 +86,7 @@ not (
     "/usr/local/bin/afb-ssh-setup-keys.sh" or "/usr/local/bin/afb-ssh-setup-keys.sh" or "/opt/puppetlabs/puppet/bin/ruby" or
     "/usr/sbin/update-exim4.conf" or "/bin/dracut"
   )
+)
 '''
 note = """## Triage and analysis
 

Original file line number	Diff line number	Diff line change
`@@ -86,6 +86,7 @@ not (`
`86`	`86`	`"/usr/local/bin/afb-ssh-setup-keys.sh" or "/usr/local/bin/afb-ssh-setup-keys.sh" or "/opt/puppetlabs/puppet/bin/ruby" or`
`87`	`87`	`"/usr/sbin/update-exim4.conf" or "/bin/dracut"`
`88`	`88`	`)`
	`89`	`+)`
`89`	`90`	`'''`
`90`	`91`	`note = """## Triage and analysis`
`91`	`92`