Rule tuning as part of Linux Detection Rules Review (#2170)

rules/linux/execution_shell_evasion_linux_binary.toml

@@ -1,7 +1,7 @@
 [metadata]
 creation_date = "2022/05/06"
 maturity = "production"
-updated_date = "2022/05/25"
+updated_date = "2022/07/28"
 
 [rule]
 author = ["Elastic"]
@@ -108,7 +108,7 @@ process where event.type == "start" and
 
   /* launching shells from unusual parents or parent+arg combos */
   (process.name in ("bash", "sh", "dash","ash") and
-    (process.parent.name in ("byebug","git","ftp")) or
+    (process.parent.name in ("byebug","git","ftp","strace")) or
 
     /* shells specified in parent args */
     /* nice rule is broken in 8.2 */