[Rule Tuning] Linux Persistence Rules (#4393)

* [Rule Tuning] Linux Persistence Rules

* Update persistence_suspicious_file_modifications.toml

* Update rules/linux/persistence_potential_persistence_script_executable_bit_set.toml

rules/linux/persistence_potential_persistence_script_executable_bit_set.toml

@@ -4,7 +4,7 @@ integration = ["endpoint", "sentinel_one_cloud_funnel"]
 maturity = "production"
 min_stack_version = "8.13.0"
 min_stack_comments = "Breaking change at 8.13.0 for SentinelOne Integration."
-updated_date = "2025/01/08"
+updated_date = "2025/01/16"
 
 [rule]
 author = ["Elastic"]
@@ -70,7 +70,8 @@ process where host.os.type == "linux" and event.type == "start" and event.action
 process.args : (
   // Misc.
   "/etc/rc.local", "/etc/rc.common", "/etc/rc.d/rc.local", "/etc/init.d/*", "/etc/update-motd.d/*",
-  "/etc/apt/apt.conf.d/*", "/etc/cron*", "/etc/init/*",
+  "/etc/apt/apt.conf.d/*", "/etc/cron*", "/etc/init/*", "/etc/NetworkManager/dispatcher.d/*",
+  "/lib/dracut/modules.d/*", "/usr/lib/dracut/modules.d/*",
 
   // XDG
   "/etc/xdg/autostart/*", "/home/*/.config/autostart/*", "/root/.config/autostart/*",