diff --git a/rules/macos/persistence_creation_modif_launch_deamon_sequence.toml b/rules/macos/persistence_creation_modif_launch_deamon_sequence.toml index 9a48875c1..a4616df08 100644 --- a/rules/macos/persistence_creation_modif_launch_deamon_sequence.toml +++ b/rules/macos/persistence_creation_modif_launch_deamon_sequence.toml @@ -1,7 +1,7 @@ [metadata] creation_date = "2020/12/07" maturity = "production" -updated_date = "2021/03/03" +updated_date = "2022/01/25" [rule] author = ["Elastic"] @@ -23,7 +23,7 @@ type = "eql" query = ''' sequence by host.id with maxspan=1m - [file where event.type != "deletion" and file.path in ("/System/Library/LaunchDaemons/*", " /Library/LaunchDaemons/*")] + [file where event.type != "deletion" and file.path in ("/System/Library/LaunchDaemons/*", "/Library/LaunchDaemons/*")] [process where event.type in ("start", "process_started") and process.name == "launchctl" and process.args == "load"] '''