[Rule Tuning] Some Tunings of several 8.9 rules (#2985)

* [Rule Tuning] Doing some quick tunings

* updated_date bump

* Update rules/linux/discovery_linux_modprobe_enumeration.toml

* Update rules/linux/discovery_linux_modprobe_enumeration.toml

* Update rules/linux/discovery_linux_sysctl_enumeration.toml

* Update rules/linux/persistence_init_d_file_creation.toml

* Update rules/linux/persistence_rc_script_creation.toml

* Update rules/linux/persistence_shared_object_creation.toml

* deprecate rule

* deprecate rule

* Update execution_abnormal_process_id_file_created.toml

* Update discovery_kernel_module_enumeration_via_proc.toml

* Update discovery_linux_modprobe_enumeration.toml

* Update execution_remote_code_execution_via_postgresql.toml

* Update discovery_potential_syn_port_scan_detected.toml

* Added 2 tunings, sorry I missed those..

* One more tune

* Update discovery_suspicious_proc_enumeration.toml

rules/linux/impact_potential_linux_ransomware_note_detected.toml

@@ -4,7 +4,7 @@ integration = ["endpoint"]
 maturity = "production"
 min_stack_comments = "New fields added: required_fields, related_integrations, setup"
 min_stack_version = "8.3.0"
-updated_date = "2023/06/15"
+updated_date = "2023/08/02"
 
 [rule]
 author = ["Elastic"]
@@ -20,9 +20,9 @@ index = ["logs-endpoint.events.*"]
 language = "eql"
 license = "Elastic License v2"
 name = "Potential Linux Ransomware Note Creation Detected"
-risk_score = 73
+risk_score = 47
 rule_id = "c8935a8b-634a-4449-98f7-bb24d3b2c0af"
-severity = "high"
+severity = "medium"
 tags = ["Domain: Endpoint", "OS: Linux", "Use Case: Threat Detection", "Tactic: Impact"]
 type = "eql"
 query = '''
@@ -43,19 +43,18 @@ sequence by host.id, process.entity_id with maxspan=1s
     file.name : (
       "*crypt*", "*restore*", "*lock*", "*recovery*", "*data*", 
       "*read*", "*instruction*", "*how_to*", "*ransom*"
-      ) ] | tail 1
+      ) and not process.name : ("go", "java", "pip*", "python*", "node", "containerd") ] | tail 1
 '''
 
-
 [[rule.threat]]
 framework = "MITRE ATT&CK"
+
 [[rule.threat.technique]]
 id = "T1486"
 name = "Data Encrypted for Impact"
 reference = "https://attack.mitre.org/techniques/T1486/"
 
-
 [rule.threat.tactic]
 id = "TA0040"
 name = "Impact"
-reference = "https://attack.mitre.org/tactics/TA0040/"
+reference = "https://attack.mitre.org/tactics/TA0040/"