diff --git a/rules/linux/lnx_apt_equationgroup_lnx.yml b/rules/linux/builtin/lnx_apt_equationgroup_lnx.yml
similarity index 100%
rename from rules/linux/lnx_apt_equationgroup_lnx.yml
rename to rules/linux/builtin/lnx_apt_equationgroup_lnx.yml
diff --git a/rules/linux/lnx_buffer_overflows.yml b/rules/linux/builtin/lnx_buffer_overflows.yml
similarity index 100%
rename from rules/linux/lnx_buffer_overflows.yml
rename to rules/linux/builtin/lnx_buffer_overflows.yml
diff --git a/rules/linux/lnx_clear_syslog.yml b/rules/linux/builtin/lnx_clear_syslog.yml
similarity index 100%
rename from rules/linux/lnx_clear_syslog.yml
rename to rules/linux/builtin/lnx_clear_syslog.yml
diff --git a/rules/linux/lnx_file_copy.yml b/rules/linux/builtin/lnx_file_copy.yml
similarity index 100%
rename from rules/linux/lnx_file_copy.yml
rename to rules/linux/builtin/lnx_file_copy.yml
diff --git a/rules/linux/lnx_ldso_preload_injection.yml b/rules/linux/builtin/lnx_ldso_preload_injection.yml
similarity index 100%
rename from rules/linux/lnx_ldso_preload_injection.yml
rename to rules/linux/builtin/lnx_ldso_preload_injection.yml
diff --git a/rules/linux/lnx_proxy_connection.yml b/rules/linux/builtin/lnx_proxy_connection.yml
similarity index 100%
rename from rules/linux/lnx_proxy_connection.yml
rename to rules/linux/builtin/lnx_proxy_connection.yml
diff --git a/rules/linux/lnx_setgid_setuid.yml b/rules/linux/builtin/lnx_setgid_setuid.yml
similarity index 100%
rename from rules/linux/lnx_setgid_setuid.yml
rename to rules/linux/builtin/lnx_setgid_setuid.yml
diff --git a/rules/linux/lnx_shell_clear_cmd_history.yml b/rules/linux/builtin/lnx_shell_clear_cmd_history.yml
similarity index 100%
rename from rules/linux/lnx_shell_clear_cmd_history.yml
rename to rules/linux/builtin/lnx_shell_clear_cmd_history.yml
diff --git a/rules/linux/lnx_shell_priv_esc_prep.yml b/rules/linux/builtin/lnx_shell_priv_esc_prep.yml
similarity index 100%
rename from rules/linux/lnx_shell_priv_esc_prep.yml
rename to rules/linux/builtin/lnx_shell_priv_esc_prep.yml
diff --git a/rules/linux/lnx_shell_susp_commands.yml b/rules/linux/builtin/lnx_shell_susp_commands.yml
similarity index 100%
rename from rules/linux/lnx_shell_susp_commands.yml
rename to rules/linux/builtin/lnx_shell_susp_commands.yml
diff --git a/rules/linux/lnx_shell_susp_log_entries.yml b/rules/linux/builtin/lnx_shell_susp_log_entries.yml
similarity index 100%
rename from rules/linux/lnx_shell_susp_log_entries.yml
rename to rules/linux/builtin/lnx_shell_susp_log_entries.yml
diff --git a/rules/linux/lnx_shell_susp_rev_shells.yml b/rules/linux/builtin/lnx_shell_susp_rev_shells.yml
similarity index 100%
rename from rules/linux/lnx_shell_susp_rev_shells.yml
rename to rules/linux/builtin/lnx_shell_susp_rev_shells.yml
diff --git a/rules/linux/lnx_shellshock.yml b/rules/linux/builtin/lnx_shellshock.yml
similarity index 100%
rename from rules/linux/lnx_shellshock.yml
rename to rules/linux/builtin/lnx_shellshock.yml
diff --git a/rules/linux/lnx_space_after_filename_.yml b/rules/linux/builtin/lnx_space_after_filename_.yml
similarity index 100%
rename from rules/linux/lnx_space_after_filename_.yml
rename to rules/linux/builtin/lnx_space_after_filename_.yml
diff --git a/rules/linux/lnx_sudo_cve_2019_14287.yml b/rules/linux/builtin/lnx_sudo_cve_2019_14287.yml
similarity index 100%
rename from rules/linux/lnx_sudo_cve_2019_14287.yml
rename to rules/linux/builtin/lnx_sudo_cve_2019_14287.yml
diff --git a/rules/linux/lnx_sudo_cve_2019_14287_user.yml b/rules/linux/builtin/lnx_sudo_cve_2019_14287_user.yml
similarity index 100%
rename from rules/linux/lnx_sudo_cve_2019_14287_user.yml
rename to rules/linux/builtin/lnx_sudo_cve_2019_14287_user.yml
diff --git a/rules/linux/lnx_susp_jexboss.yml b/rules/linux/builtin/lnx_susp_jexboss.yml
similarity index 100%
rename from rules/linux/lnx_susp_jexboss.yml
rename to rules/linux/builtin/lnx_susp_jexboss.yml
diff --git a/rules/linux/lnx_symlink_etc_passwd.yml b/rules/linux/builtin/lnx_symlink_etc_passwd.yml
similarity index 100%
rename from rules/linux/lnx_symlink_etc_passwd.yml
rename to rules/linux/builtin/lnx_symlink_etc_passwd.yml