Prep for Release 9.0 (#4550)

rules/linux/execution_cupsd_foomatic_rip_shell_execution.toml

@@ -2,21 +2,24 @@
 creation_date = "2024/09/27"
 integration = ["endpoint", "crowdstrike", "sentinel_one_cloud_funnel"]
 maturity = "production"
-min_stack_version = "8.13.0"
-min_stack_comments = "Breaking change at 8.13.0 for SentinelOne Integration."
-updated_date = "2025/02/04"
+updated_date = "2025/03/20"
 
 [rule]
 author = ["Elastic"]
 description = """
 This detection rule addresses multiple vulnerabilities in the CUPS printing system, including CVE-2024-47176,
-CVE-2024-47076, CVE-2024-47175, and CVE-2024-47177. Specifically, this rule detects shell executions from the foomatic-rip
-parent process. These flaws impact components like cups-browsed, libcupsfilters, libppd, and foomatic-rip, allowing
-remote unauthenticated attackers to manipulate IPP URLs or inject malicious data through crafted UDP packets or network
-spoofing. This can result in arbitrary command execution when a print job is initiated.
+CVE-2024-47076, CVE-2024-47175, and CVE-2024-47177. Specifically, this rule detects shell executions from the
+foomatic-rip parent process. These flaws impact components like cups-browsed, libcupsfilters, libppd, and foomatic-rip,
+allowing remote unauthenticated attackers to manipulate IPP URLs or inject malicious data through crafted UDP packets or
+network spoofing. This can result in arbitrary command execution when a print job is initiated.
 """
 from = "now-9m"
-index = ["endgame-*", "logs-crowdstrike.fdr*", "logs-endpoint.events.process*", "logs-sentinel_one_cloud_funnel.*"]
+index = [
+    "endgame-*",
+    "logs-crowdstrike.fdr*",
+    "logs-endpoint.events.process*",
+    "logs-sentinel_one_cloud_funnel.*",
+]
 language = "eql"
 license = "Elastic License v2"
 name = "Cupsd or Foomatic-rip Shell Execution"
@@ -113,6 +116,7 @@ tags = [
 ]
 timestamp_override = "event.ingested"
 type = "eql"
+
 query = '''
 process where host.os.type == "linux" and event.type == "start" and
   event.action in ("exec", "exec_event", "start", "ProcessRollup2") and process.parent.name == "foomatic-rip" and
@@ -125,15 +129,17 @@ process where host.os.type == "linux" and event.type == "start" and
   )
 '''
 
+
 [[rule.threat]]
 framework = "MITRE ATT&CK"
-
 [[rule.threat.technique]]
 id = "T1203"
 name = "Exploitation for Client Execution"
 reference = "https://attack.mitre.org/techniques/T1203/"
 
+
 [rule.threat.tactic]
 id = "TA0002"
 name = "Execution"
 reference = "https://attack.mitre.org/tactics/TA0002/"
+