Revert "Back-porting Version Trimming (#3681)"

This reverts commit 71d2c59b5c.

rules/linux/persistence_linux_shell_activity_via_web_server.toml

@@ -2,7 +2,9 @@
 creation_date = "2023/03/04"
 integration = ["endpoint"]
 maturity = "production"
-updated_date = "2024/05/21"
+min_stack_comments = "New fields added: required_fields, related_integrations, setup"
+min_stack_version = "8.3.0"
+updated_date = "2024/02/21"
 
 [transform]
 [[transform.osquery]]
@@ -25,12 +27,11 @@ query = "SELECT name, cmdline, parent, path, uid FROM processes WHERE uid = {{pr
 label = "Osquery - Retrieve Crontab Information"
 query = "SELECT * FROM crontab"
 
-
 [rule]
 author = ["Elastic"]
 description = """
-Identifies suspicious commands executed via a web server, which may suggest a vulnerability and remote shell access.
-Attackers may exploit a vulnerability in a web application to execute commands via a web server, or place a backdoor
+Identifies suspicious commands executed via a web server, which may suggest a vulnerability and remote shell access. 
+Attackers may exploit a vulnerability in a web application to execute commands via a web server, or place a backdoor 
 file that can be abused to gain code execution as a mechanism for persistence.
 """
 false_positives = [
@@ -130,19 +131,18 @@ For more details on Elastic Defend refer to the [helper guide](https://www.elast
 """
 severity = "high"
 tags = [
-    "Domain: Endpoint",
-    "OS: Linux",
-    "Use Case: Threat Detection",
-    "Tactic: Persistence",
-    "Tactic: Initial Access",
-    "Data Source: Elastic Endgame",
-    "Use Case: Vulnerability",
-    "Resources: Investigation Guide",
-    "Data Source: Elastic Defend",
-]
+        "Domain: Endpoint",
+        "OS: Linux",
+        "Use Case: Threat Detection",
+        "Tactic: Persistence",
+        "Tactic: Initial Access",
+        "Data Source: Elastic Endgame",
+        "Use Case: Vulnerability",
+        "Resources: Investigation Guide",
+        "Data Source: Elastic Defend"
+        ]
 timestamp_override = "event.ingested"
 type = "eql"
-
 query = '''
 process where host.os.type == "linux" and event.type == "start" and
 event.action in ("exec", "exec_event") and process.parent.executable : (
@@ -165,34 +165,33 @@ process.name : (
   ) and not process.name == "phpquery"
 '''
 
-
 [[rule.threat]]
 framework = "MITRE ATT&CK"
+
 [[rule.threat.technique]]
 id = "T1505"
 name = "Server Software Component"
 reference = "https://attack.mitre.org/techniques/T1505/"
+
 [[rule.threat.technique.subtechnique]]
 id = "T1505.003"
 name = "Web Shell"
 reference = "https://attack.mitre.org/techniques/T1505/003/"
 
-
-
 [rule.threat.tactic]
 id = "TA0003"
 name = "Persistence"
 reference = "https://attack.mitre.org/tactics/TA0003/"
+
 [[rule.threat]]
 framework = "MITRE ATT&CK"
+
 [[rule.threat.technique]]
 id = "T1190"
 name = "Exploit Public-Facing Application"
 reference = "https://attack.mitre.org/techniques/T1190/"
 
-
 [rule.threat.tactic]
 id = "TA0001"
 name = "Initial Access"
 reference = "https://attack.mitre.org/tactics/TA0001/"
-