[Rule Tuning] Event Aggregation - Fix event.action & event.type c…

…onditions (#4445)

* [Rule Tuning] Event Aggregation - Fix `event.action` & `event.type` conditions

* .

---------

Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>

Removed changes from:
- rules/linux/execution_tc_bpf_filter.toml
- rules/windows/persistence_local_scheduled_task_creation.toml

(selectively cherry picked from commit 5155f47)

rules/integrations/cloud_defend/execution_interactive_shell_spawned_from_inside_a_container.toml

@@ -2,7 +2,7 @@
 creation_date = "2023/04/26"
 integration = ["cloud_defend"]
 maturity = "production"
-updated_date = "2025/01/15"
+updated_date = "2025/02/04"
 
 [rule]
 author = ["Elastic"]
@@ -41,8 +41,8 @@ process where container.id: "*" and
 event.type== "start" and
 
 /*D4C consolidates closely spawned event.actions, this excludes end actions to only capture ongoing processes*/
-event.action in ("fork", "exec") and event.action != "end"
- and process.entry_leader.same_as_process== false and
+event.action in ("fork", "exec") and
+ process.entry_leader.same_as_process== false and
 (
 (process.executable: "*/*sh" and process.args: ("-i", "-it")) or
 process.args: "*/*sh"

rules/integrations/cloud_defend/lateral_movement_ssh_process_launched_inside_a_container.toml

@@ -2,7 +2,7 @@
 creation_date = "2023/05/12"
 integration = ["cloud_defend"]
 maturity = "production"
-updated_date = "2025/01/15"
+updated_date = "2025/02/04"
 
 [rule]
 author = ["Elastic"]
@@ -45,7 +45,7 @@ type = "eql"
 
 query = '''
 process where container.id: "*" and event.type== "start" and
-event.action in ("fork", "exec") and event.action != "end" and
+event.action in ("fork", "exec") and
 process.name: ("sshd", "ssh", "autossh")
 '''
 note = """## Triage and analysis

rules/macos/execution_scripting_osascript_exec_followed_by_netcon.toml

@@ -2,7 +2,7 @@
 creation_date = "2020/12/07"
 integration = ["endpoint"]
 maturity = "production"
-updated_date = "2025/02/04"
+updated_date = "2025/02/07"
 
 [rule]
 author = ["Elastic"]
@@ -61,7 +61,7 @@ type = "eql"
 query = '''
 sequence by host.id, process.entity_id with maxspan=30s
  [process where host.os.type == "macos" and event.type == "start" and process.name == "osascript"]
- [network where host.os.type == "macos" and event.type != "end" and process.name == "osascript" and destination.ip != "::1" and
+ [network where host.os.type == "macos" and event.type == "start" and process.name == "osascript" and destination.ip != "::1" and
   not cidrmatch(destination.ip,
     "10.0.0.0/8", "127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12", "192.0.0.0/24", "192.0.0.0/29", "192.0.0.8/32",
     "192.0.0.9/32", "192.0.0.10/32", "192.0.0.170/32", "192.0.0.171/32", "192.0.2.0/24", "192.31.196.0/24",