Fix syntax errors in Linux persistence detection rules

[Copilot]

Syntax and type errors in 6 Linux persistence rules were causing REACT validation failures.

Changes

• persistence_apt_package_manager_file_creation.toml: Missing comma in exclusion list
• persistence_boot_file_copy.toml: Unclosed parenthesis in condition block
• persistence_chkconfig_service_add.toml: Unclosed string literal in executable path
• persistence_linux_shell_activity_via_web_server.toml:
  • user.id values converted from int to string (field type mismatch)
  • Added ? operator for optional process.working_directory field
• persistence_openssl_passwd_hash_generation.toml: Incorrect or operator in args list (should be comma-separated)
• persistence_process_capability_set_via_setcap.toml: Added ? operator for optional field

# Before
user.id in (33, 498, 48) or
(process.name == "java" and process.working_directory like "/u0?/*")

# After
user.id in ("33", "498", "48") or
(process.name == "java" and ?process.working_directory like "/u0?/*")

All changes are syntax corrections only - no detection logic modified.

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.