Change status for old rules

rules/linux/macos/process_creation/macos_binary_padding.yml

@@ -1,33 +1,32 @@
 title: 'Binary Padding'
 id: 95361ce5-c891-4b0a-87ca-e24607884a96
-status: experimental
+status: test
 description: 'Adversaries may use binary padding to add junk data and change the on-disk representation of malware. This rule detect using dd and truncate to add a junk data to file.'
-    # For this rule to work you must enable audit of process execution in OpenBSM, see
-    # https://osquery.readthedocs.io/en/stable/deployment/process-auditing/#macos-process-socket-auditing
 author: 'Igor Fits, Mikhail Larin, oscd.community'
-date: 2020/10/19
 references:
-    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1027.001/T1027.001.md
+  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1027.001/T1027.001.md
+date: 2020/10/19
+modified: 2021/11/27
 logsource:
-    product: macos
-    category: process_creation
+  product: macos
+  category: process_creation
 detection:
-    selection1:
-        Image|endswith:
-             - '/truncate'
-        CommandLine|contains:
-             - '-s'
-    selection2:
-        Image|endswith:
-             - '/dd'
-        CommandLine|contains:
-             - 'if='
-    filter:
-        CommandLine|contains: 'of='
-    condition: selection1 or (selection2 and not filter)
+  selection1:
+    Image|endswith:
+      - '/truncate'
+    CommandLine|contains:
+      - '-s'
+  selection2:
+    Image|endswith:
+      - '/dd'
+    CommandLine|contains:
+      - 'if='
+  filter:
+    CommandLine|contains: 'of='
+  condition: selection1 or (selection2 and not filter)
 falsepositives:
-    - 'Legitimate script work'
+  - 'Legitimate script work'
 level: high
 tags:
-    - attack.defense_evasion
-    - attack.t1027.001
+  - attack.defense_evasion
+  - attack.t1027.001