[Rule FN Tuning] System V Init Script Created

[Aegrah]

Summary

Tuning this rule to also trigger on /etc/init and /etc/inittab(2) file creations. This stems from a false negative observed within the Gafgyt malware family.

[elastic-vault-github-plugin-prod]

⛔️ Test failed

Results

• ❌ System V Init Script Created (eql)
  • coverage_issue: no_rta
  • stack_validation_failed: no_rta

[Copilot]

🟡 Changes recommended

The new /etc/init match likely misses creations under the /etc/init/ directory, and the rule’s narrative/Osquery transforms are now out of sync with the expanded detection scope.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR tunes the existing Linux persistence rule “System V Init Script Created” to reduce false negatives (notably observed with Gafgyt) by expanding the file creation paths it matches beyond /etc/init.d/.

Changes:

• Updated rule metadata updated_date to 2026/09/10.
• Expanded the EQL file path match from only /etc/init.d/* to also include /etc/init and /etc/inittab*.

File summaries

File	Description
rules/linux/persistence_init_d_file_creation.toml	Expands the rule’s file path matching and updates the rule’s updated_date to reflect the tuning.

Review details

Suppressed comments (1)

rules/linux/persistence_init_d_file_creation.toml:157

• The rule scope now includes /etc/init and /etc/inittab*, but the description, investigation guide text, and Osquery listing transforms still describe only /etc/init.d/; this can confuse triage and lead to irrelevant Osquery output for alerts on the new paths.

and file.path like ("/etc/init.d/*", "/etc/init", "/etc/inittab*") and
not (

• Files reviewed: 1/1 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[elastic-vault-github-plugin-prod]

⛔️ Test failed

Results

• ❌ System V Init Script Created (eql)
  • coverage_issue: no_rta
  • stack_validation_failed: no_rta

[eric-forte-elastic]

One comment, otherwise looks good to me 👍

[elastic-vault-github-plugin-prod]

⛔️ Test failed

Results

• ❌ System V Init Script Created (eql)
  • coverage_issue: no_rta
  • stack_validation_failed: no_rta

[elastic-vault-github-plugin-prod]

⛔️ Test failed

Results

• ❌ System V Init Script Created (eql)
  • coverage_issue: no_rta
  • stack_validation_failed: no_rta