[Rule tuning] existing hpining and strace activity rule.

[shashank-elastic]

Issues

#2027

Summary

1. For Rule 1 in consideration already MITRE details have been added as part of [Rule Tuning] Add MITRE Details to exisisting hpining activity rule. #2012. This issue tracks the following changes in the description and query changes from KQL to EQL.
   -- This won't be done as it was rejected in review for having no impact.
2. For Rule 2 in consideration, the issue tracks MITRE details, and description changes.

Contributor checklist

• Have you signed the contributor license agreement?
• Have you followed the contributor guidelines?

[brokensound77]

Why would these need to be converted to EQL rules?

[w0rk3r]

++, if we are not using sequences here, the type conversion is not needed

[shashank-elastic]

@brokensound77 / @w0rk3r We were under the impression EQL had performance benefits over KQL and that we would want to unify our rules but if that's not the case then I guess we will leave them and just tune as is.

[brokensound77]

@brokensound77 / @w0rk3r We were under the impression EQL had performance benefits over KQL and that we would want to unify our rules but if that's not the case then I guess we will leave them and just tune as is.

Yea, in this case, there is no benefit, so I think we are ok to close.

[shashank-elastic]

@brokensound77 --> The PR contains MITRE details addition along with query changes, we can revert the query alone and keep the PR open to judge the other aspects.!

[shashank-elastic]

I will be reverting query changes alone!

[shashank-elastic]

@brokensound77 / @w0rk3r the query changes are reverted please review the other tuning details.

[Mikaayenson]

LGTM

[imays11]

Looks good!

Changes were requested for an older version of PR. Those changes were already reverted in this PR