[Rule Tuning] Fixing Typo in the macOS persistence emond modification rule

[litemars]

Pull Request

Summary - What I changed

The file path was wrong, please check this link as reference: https://cocomelonc.github.io/macos/2026/04/02/mac-malware-persistence-9.html

[w0rk3r]

Nice, thanks @litemars

Can you bump the updated_date?

[litemars]

Hi @w0rk3r,

Could I also write my name in the author section even though I didn't fully create the rule? I feel like I have already fine-tuned more than 15 rules in Elastic.

Cheers,
M

[eric-forte-elastic]

Hi @w0rk3r,

Could I also write my name in the author section even though I didn't fully create the rule? I feel like I have already fine-tuned more than 15 rules in Elastic.

Cheers, M

Given that this change is a substantial part of the rule, yes I think you should add your name. We have many rules that are co-authored (including co-authored as a result of tuning).

Precedence:

• [Rule Tuning] Suspicious CertUtil Commands #1564
• [Tuning] M365 Exchange Inbox Forwarding Rule Created #5647
• [Tuning] M365 Exchange Inbox Phishing Evasion Rule Created #5648

[eric-forte-elastic]

Tuning looks good 👍

[w0rk3r]

@litemars, I don't see a problem. Go ahead, I'll wait for it and then we can merge :)