++

rules/linux/persistence_kernel_object_file_creation.toml

@@ -93,7 +93,7 @@ reference = "https://attack.mitre.org/tactics/TA0005/"
 
 [rule.new_terms]
 field = "new_terms_fields"
-value = ["process.executable.executable"]
+value = ["process.name", "file.name"]
 
 [[rule.new_terms.history_window_start]]
 field = "history_window_start"