Rule updates 2019 04.v4 mitre persistence (#578)
Rule updates 2019 04.v4 mitre persistence (#578)

* rules update: add rules for mitre framework

* rules update: add mitre persistence rules

* minor changes

* add exclude hidden directories list

* limit hidden files creation in container

* minor fix

* minor fix

* tune rules to have only_check_container macro

* rules update: add rules for remove data from disk and clear log

* minor changes

* minor fix rule name

* add check_container_only macro

* addresses comments

* add rule for updating package repos

* Don't consider dd a bulk writer

Threre are enough legitimate cases to exclude it.

* Make cron/chmod policies opt-in

They have enough legitimate uses that we shouldn't run by default.

* minor fix

draios/falco,draios/falco,draios/falco,draios/falco,draios/falco,draios/falco,draios/falco,draios/falco