{
  "model_id": "SOC.038",
  "name": "Init.d Script Added",
  "description": "New init.d script — legacy persistence vector still used by older malware.",
  "threshold": 0.7,
  "evaluations": [
    {
      "name": "InitAdd",
      "type": "comparison",
      "left": "event.type",
      "operator": "==",
      "right": "persistence.initd.added",
      "weight": 4
    }
  ],
  "actions": [
    {
      "type": "emit_alert",
      "reason": "New init.d script — review for backdoor patterns."
    }
  ],
  "mitre_tactics": [
    "Persistence"
  ],
  "mitre_techniques": [
    "T1037"
  ],
  "severity": "high",
  "observables": [
    "event.raw.path"
  ]
}