For audit.rules purposes, if the stig.rules from the repo audits on unlink, does that cover rmdir?