Update query

Author: Aegrah

hunting/linux/docs/persistence_via_web_shell.md

@@ -17,7 +17,7 @@
 ```sql
 from logs-endpoint.events.file-*
 | keep @timestamp, host.os.type, event.action, file.extension, process.name, agent.id, file.name, process.executable
-| where @timestamp > now() - 90 day
+| where @timestamp > now() - 30 days
 | where host.os.type == "linux" and event.action in ("rename", "creation") and
 file.extension in ("php", "py", "pl", "rb", "rs", "lua", "jsp") and not (
   // Add your noisy exclusions here

hunting/linux/queries/persistence_via_web_shell.toml

@@ -19,7 +19,7 @@ query = [
 '''
 from logs-endpoint.events.file-*
 | keep @timestamp, host.os.type, event.action, file.extension, process.name, agent.id, file.name, process.executable
-| where @timestamp > now() - 90 day
+| where @timestamp > now() - 30 days
 | where host.os.type == "linux" and event.action in ("rename", "creation") and
 file.extension in ("php", "py", "pl", "rb", "rs", "lua", "jsp") and not (
   // Add your noisy exclusions here