Updates

Author: Aegrah

hunting/index.md

@@ -40,13 +40,13 @@ Here are the queries currently available:
 - [OSQuery SUID Hunting](./linux/docs/privilege_escalation_via_suid_binaries.md) (ES|QL)
 - [Persistence Through Reverse/Bind Shells](./linux/docs/persistence_reverse_bind_shells.md) (ES|QL)
 - [Persistence via Cron](./linux/docs/persistence_via_cron.md) (ES|QL)
-- [Persistence via Dynamic Linker Hijacking](./linux/docs/persistence_via_dynamic_linker_hijacking.md) (ES|QL)
-- [Persistence via Loadable Kernel Modules](./linux/docs/persistence_via_loadable_kernel_modules.md) (ES|QL)
 - [Persistence via DPKG/RPM Package](./linux/docs/persistence_via_rpm_dpkg_installer_packages.md) (ES|QL)
 - [Persistence via Docker Container](./linux/docs/persistence_via_malicious_docker_container.md) (ES|QL)
+- [Persistence via Dynamic Linker Hijacking](./linux/docs/persistence_via_dynamic_linker_hijacking.md) (ES|QL)
+- [Persistence via Loadable Kernel Modules](./linux/docs/persistence_via_loadable_kernel_modules.md) (ES|QL)
 - [Persistence via Message-of-the-Day](./linux/docs/persistence_via_message_of_the_day.md) (ES|QL)
 - [Persistence via Package Manager](./linux/docs/persistence_via_package_manager.md) (ES|QL)
-- [Persistence via Pluggable Authentication Modules](./linux/docs/persistence_via_pluggable_authentication_module.md) (ES|QL)
+- [Persistence via Pluggable Authentication Modules (PAM)](./linux/docs/persistence_via_pluggable_authentication_module.md) (ES|QL)
 - [Persistence via SSH Configurations and/or Keys](./linux/docs/persistence_via_ssh_configurations_and_keys.md) (ES|QL)
 - [Persistence via System V Init](./linux/docs/persistence_via_sysv_init.md) (ES|QL)
 - [Persistence via Systemd (Timers)](./linux/docs/persistence_via_systemd_timers.md) (ES|QL)

hunting/index.yml

@@ -221,7 +221,7 @@ linux:
     - T1037.004
     - T1546.003
   2a3c46b8-7bd6-4bc4-a4a8-a1af114ea152:
-    name: Persistence via Pluggable Authentication Modules
+    name: Persistence via Pluggable Authentication Modules (PAM)
     path: ./linux/queries/persistence_via_pluggable_authentication_module.toml
     mitre:
     - T1556.003

hunting/linux/docs/persistence_via_pluggable_authentication_module.md

@@ -1,4 +1,4 @@
-# Persistence via Pluggable Authentication Modules
+# Persistence via Pluggable Authentication Modules (PAM)
 
 ---
 
@@ -10,7 +10,7 @@
 - **UUID:** `2a3c46b8-7bd6-4bc4-a4a8-a1af114ea152`
 - **Integration:** [endpoint](https://docs.elastic.co/integrations/endpoint)
 - **Language:** `[ES|QL, SQL]`
-- **Source File:** [Persistence via Pluggable Authentication Modules](../queries/persistence_via_pluggable_authentication_module.toml)
+- **Source File:** [Persistence via Pluggable Authentication Modules (PAM)](../queries/persistence_via_pluggable_authentication_module.toml)
 
 ## Query
 

pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "detection_rules"
-version = "0.3.9"
+version = "0.3.10"
 description = "Detection Rules is the home for rules used by Elastic Security. This repository is used for the development, maintenance, testing, validation, and release of rules for Elastic Security’s Detection Engine."
 readme = "README.md"
 requires-python = ">=3.12"