additional modifications on commands and process names

rules/linux/lnx_local_groups.yml

@@ -12,10 +12,10 @@ logsource:
 detection:
   selection_1:
     ProcessName|endswith:
-      - '*/groups'
+      - '/groups'
   selection_2:
     ProcessName|endswith:
-      - '*/cat'
+      - '/cat'
     CommandLine|contains:
       - '/etc/group'
   condition: 1 of them

rules/linux/macos_local_groups.yml

@@ -12,19 +12,21 @@ logsource:
 detection:
   selection_1:
     ProcessName|endswith:
-      - '*/dscacheutil'
+      - '/dscacheutil'
-    CommandLine|contains:
+    CommandLine|contains|all:
-      - '-q group'
+      - '-q'
+      - 'group'
   selection_2:
     ProcessName|endswith:
-      - '*/cat'
+      - '/cat'
     CommandLine|contains:
       - '/etc/group'
   selection_3:
     ProcessName|endswith:
-      - '*/dscl'
+      - '/dscl'
-    CommandLine|contains:
+    CommandLine|contains|all:
-      - '. -list /groups'
+      - '-list'
+      - '/groups'
   condition: 1 of them
 falsepositives:
   - Legitimate administration activities