[Rule Tuning] Potential Reverse Shell Activity via Terminal (#2077)

* adjusted query rule to exclude noisy FPs

* adjusted event.action to be event.type

(cherry picked from commit 7581234fe8)

rules/cross-platform/execution_revershell_via_shell_cmd.toml

@@ -1,7 +1,7 @@
 [metadata]
 creation_date = "2020/01/07"
 maturity = "production"
-updated_date = "2022/03/31"
+updated_date = "2022/07/06"
 
 [rule]
 author = ["Elastic"]
@@ -30,7 +30,12 @@ type = "eql"
 query = '''
 process where event.type in ("start", "process_started") and
   process.name in ("sh", "bash", "zsh", "dash", "zmodload") and
-  process.args:("*/dev/tcp/*", "*/dev/udp/*", "zsh/net/tcp", "zsh/net/udp")
+  process.args : ("*/dev/tcp/*", "*/dev/udp/*", "*zsh/net/tcp*", "*zsh/net/udp*") and
+
+  /* noisy FPs */
+  not (process.parent.name : "timeout" and process.executable : "/var/lib/docker/overlay*") and
+  not process.command_line : ("*/dev/tcp/sirh_db/*", "*/dev/tcp/remoteiot.com/*", "*dev/tcp/elk.stag.one/*", "*dev/tcp/kafka/*", "*/dev/tcp/$0/$1*", "*/dev/tcp/127.*", "*/dev/udp/127.*", "*/dev/tcp/localhost/*") and
+  not process.parent.command_line : "runc init"
 '''