separate rules to submodule (#304)

* rm: rules

* Add: hayabusa-rules to submodule

rules/sigma/powershell/powershell_script/powershell_wmimplant.yml

@@ -1,45 +0,0 @@
-
-title: WMImplant Hack Tool
-author: NVISO
-date: 2020/03/26
-description: Detects parameters used by WMImplant
-detection:
-  SELECTION_1:
-    ScriptBlockText:
-    - '*WMImplant*'
-    - '* change_user *'
-    - '* gen_cli *'
-    - '* command_exec *'
-    - '* disable_wdigest *'
-    - '* disable_winrm *'
-    - '* enable_wdigest *'
-    - '* enable_winrm *'
-    - '* registry_mod *'
-    - '* remote_posh *'
-    - '* sched_job *'
-    - '* service_mod *'
-    - '* process_kill *'
-    - '* active_users *'
-    - '* basic_info *'
-    - '* power_off *'
-    - '* vacant_system *'
-    - '* logon_events *'
-  condition: SELECTION_1
-falsepositives:
-- Administrative scripts that use the same keywords.
-id: 8028c2c3-e25a-46e3-827f-bbb5abf181d7
-level: high
-logsource:
-  category: ps_script
-  definition: Script block logging must be enabled
-  product: windows
-modified: 2021/10/16
-references:
-- https://github.com/FortyNorthSecurity/WMImplant
-status: experimental
-tags:
-- attack.execution
-- attack.t1047
-- attack.t1059.001
-- attack.t1086
-ruletype: SIGMA