Back-porting Version Trimming (#3681)

rules/linux/privilege_escalation_suspicious_cap_setuid_python_execution.toml

@@ -2,18 +2,16 @@
 creation_date = "2023/09/05"
 integration = ["endpoint"]
 maturity = "production"
-min_stack_comments = "New fields added: required_fields, related_integrations, setup"
-min_stack_version = "8.3.0"
-updated_date = "2024/03/08"
+updated_date = "2024/05/21"
 
 [rule]
 author = ["Elastic"]
 description = """
-This detection rule monitors for the execution of a system command with setuid or setgid capabilities via Python, 
+This detection rule monitors for the execution of a system command with setuid or setgid capabilities via Python,
 followed by a uid or gid change to the root user. This sequence of events may indicate successful privilege escalation.
-Setuid (Set User ID) and setgid (Set Group ID) are Unix-like OS features that enable processes to run with elevated 
-privileges, based on the file owner or group. Threat actors can exploit these attributes to escalate privileges to the 
-privileges that are set on the binary that is being executed. 
+Setuid (Set User ID) and setgid (Set Group ID) are Unix-like OS features that enable processes to run with elevated
+privileges, based on the file owner or group. Threat actors can exploit these attributes to escalate privileges to the
+privileges that are set on the binary that is being executed.
 """
 from = "now-9m"
 index = ["logs-endpoint.events.*"]
@@ -49,8 +47,15 @@ For more details on Elastic Agent configuration settings, refer to the [helper g
 For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
 """
 severity = "medium"
-tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Privilege Escalation", "Data Source: Elastic Defend"]
+tags = [
+    "Domain: Endpoint",
+    "OS: Linux",
+    "Use Case: Threat Detection",
+    "Tactic: Privilege Escalation",
+    "Data Source: Elastic Defend",
+]
 type = "eql"
+
 query = '''
 sequence by host.id, process.entity_id with maxspan=1s
   [process where host.os.type == "linux" and event.type == "start" and event.action == "exec" and 
@@ -59,9 +64,9 @@ sequence by host.id, process.entity_id with maxspan=1s
    (user.id == "0" or group.id == "0")]
 '''
 
+
 [[rule.threat]]
 framework = "MITRE ATT&CK"
-
 [[rule.threat.technique]]
 id = "T1068"
 name = "Exploitation for Privilege Escalation"
@@ -71,12 +76,13 @@ reference = "https://attack.mitre.org/techniques/T1068/"
 id = "T1548"
 name = "Abuse Elevation Control Mechanism"
 reference = "https://attack.mitre.org/techniques/T1548/"
-
 [[rule.threat.technique.subtechnique]]
 id = "T1548.001"
 name = "Setuid and Setgid"
 reference = "https://attack.mitre.org/techniques/T1548/001/"
 
+
+
 [rule.threat.tactic]
 id = "TA0004"
 name = "Privilege Escalation"