Add missing detections for MDE on Linux

[jonade]

Pull Request Template

Description

Please provide the below information so we can validate before merging:

1. Does the proposed EDR feature align with our definition of telemetry?(definition here) - Yes
2. Could you please provide documentation to support the telemetry you are proposing?

• https://learn.microsoft.com/en-gb/defender-xdr/advanced-hunting-devicelogonevents-table
• https://learn.microsoft.com/en-gb/defender-xdr/advanced-hunting-deviceevents-table

3. If no documentation is available for all the categories you are proposing, could you provide screenshots or sanitized logs?

1: Failed Logons - Available in the GUI in device Timeline for Action Type of 'LogonFailed' as well as KQL in AH table

DeviceLogonEvents
| where DeviceName == "contoso-linux"
| where ActionType == 'LogonFailed'

2: Script content - Available in the GUI in device Timeline for Action Type of 'ScriptContent' as well as KQL in AH table

DeviceEvents
| where DeviceName == "contoso-linux"
| where ActionType == "ScriptContent"

Type of change

Please delete options that are not relevant.

• Feature Improvement (non-breaking change which fixes an issue)
• New feature (adding additional EDR product or proposing new event categories/sub-categories)
• This change requires a documentation update
• New tool (suggesting additional tools for improving collection and analysis)

How Has This Been Tested?

Test Configuration:

• EDR version: 101.24102.0000
• Operating System version: Ubuntu

Checklist:

• My code follows the style guidelines of this project
• I have performed a self-review of my own code
• I have made corresponding changes to the documentation
• I have added tests that prove my corrections or additions are accurate
• I have checked my code and corrected any misspellings

[tsale]

Thank you 🙏 And thanks for providing the evidence making my life easier!🙂