I dont even know pt 2

Author: sd9777

rules/linux/file_event/file_event_lnx_new_suid_file.yml

@@ -1,37 +1,34 @@
-# ./rules/linux/file_event/file_event_lnx_new_suid_file.yml
 title: Linux New SUID/SGID File Creation
 id: b6f8d3a2-4c9e-4f1e-9a2b-6e7d8c9f0a1b
 status: experimental
 description: Detects creation or permission changes that set the SUID (set-user-ID) or SGID (set-group-ID) bits on files — commonly used by attackers for privilege escalation or persistence.
 references:
-    - https://attack.mitre.org/techniques/T1548/004/
+  - https://attack.mitre.org/techniques/T1548/004/
 author: Sesha Duraiarasan
 date: 2025-10-09
 tags:
-    - attack.privilege-escalation
-
-    - attack.t1548
+  - attack.privilege-escalation
+  - attack.t1548
 logsource:
-    product: linux
-category: file_event
+  product: linux
+  category: file_event
 detection:
-    selection_chmod:
-        Command|contains:
-          - 'chmod 4755'
-          - 'chmod 4750'
-          - 'chmod 4777'
-          - 'chmod 2755'
-          - 'chmod +s'
-selection_tmp_paths:
+  selection_chmod:
+    Command|contains:
+      - 'chmod 4755'
+      - 'chmod 4750'
+      - 'chmod 4777'
+      - 'chmod 2755'
+      - 'chmod +s'
+  selection_tmp_paths:
     TargetFilename|contains:
       - '/tmp/'
       - '/usr/local/bin/'
       - '/opt/'
       - '/home/'
-selection_filemode:
+  selection_filemode:
     FileMode|contains: 's'
-condition: selection_chmod or (selection_tmp_paths and selection_filemode)
+  condition: selection_chmod or (selection_tmp_paths and selection_filemode)
 falsepositives:
-  - Legitimate package installs or administrative tasks that intentionally set SUID/SGID on tools (consider whitelisting package manager operations or known installers).
-  - Legitimate package installs or administrative tasks that intentionally set SUID/SGID on tools (consider whitelisting package manager operations or known installers)
-level: high
+  - Legitimate package installs or administrative tasks that intentionally set SUID/SGID on tools
+level: high