[Rule Tuning] File Transfer Utility Launched from Unusual Parent

### Link to Rule

https://github.com/elastic/detection-rules/blob/main/rules/linux/exfiltration_unusual_file_transfer_utility_launched.toml

### Rule Tuning Type

Data Quality - Ensuring integrity and quality of data used by detection rules.

### Description

Hello!

I would like to ask a few questions about this rule.

Would it be possible to keep columns like `process.command_line`? Those potentially contain command arguments that could help analyst differentiate between a malicious execution and a benign one. Also, if this field is discarded, exceptions that utilize this field will not work, right?

My other question is about filters that look for script interpreters (like "*.py"). Rule uses `process.parent.name` in the query, but is it going to contain the script name or just the name of the interpreter (for example "python3.11")?

### Example Data

_No response_