Feature/addruletype to sigma rule#230 (#235)

* added ruletype to SIGMA rule #230

* added ruletype to SIGMA rule converter tool #231

rules/sigma/powershell/powershell_module/powershell_alternate_powershell_hosts.yml

@@ -28,3 +28,4 @@ tags:
 - attack.execution
 - attack.t1059.001
 - attack.t1086
+ruletype: SIGMA

rules/sigma/powershell/powershell_module/powershell_bad_opsec_artifacts.yml

@@ -38,3 +38,4 @@ tags:
 - attack.execution
 - attack.t1059.001
 - attack.t1086
+ruletype: SIGMA

rules/sigma/powershell/powershell_module/powershell_clear_powershell_history.yml

@@ -37,3 +37,4 @@ tags:
 - attack.defense_evasion
 - attack.t1070.003
 - attack.t1146
+ruletype: SIGMA

rules/sigma/powershell/powershell_module/powershell_decompress_commands.yml

@@ -27,3 +27,4 @@ status: experimental
 tags:
 - attack.defense_evasion
 - attack.t1140
+ruletype: SIGMA

rules/sigma/powershell/powershell_module/powershell_get_clipboard.yml

@@ -27,3 +27,4 @@ status: experimental
 tags:
 - attack.collection
 - attack.t1115
+ruletype: SIGMA

rules/sigma/powershell/powershell_module/powershell_invoke_obfuscation_clip.yml

@@ -27,3 +27,4 @@ tags:
 - attack.t1027
 - attack.execution
 - attack.t1059.001
+ruletype: SIGMA

rules/sigma/powershell/powershell_module/powershell_invoke_obfuscation_obfuscated_iex.yml

@@ -40,3 +40,4 @@ tags:
 - attack.execution
 - attack.t1059.001
 - attack.t1086
+ruletype: SIGMA

rules/sigma/powershell/powershell_module/powershell_invoke_obfuscation_stdin.yml

@@ -27,3 +27,4 @@ tags:
 - attack.t1027
 - attack.execution
 - attack.t1059.001
+ruletype: SIGMA

rules/sigma/powershell/powershell_module/powershell_invoke_obfuscation_var.yml

@@ -27,3 +27,4 @@ tags:
 - attack.t1027
 - attack.execution
 - attack.t1059.001
+ruletype: SIGMA

rules/sigma/powershell/powershell_module/powershell_invoke_obfuscation_via_compress.yml

@@ -27,3 +27,4 @@ tags:
 - attack.t1027
 - attack.execution
 - attack.t1059.001
+ruletype: SIGMA

rules/sigma/powershell/powershell_module/powershell_invoke_obfuscation_via_rundll.yml

@@ -27,3 +27,4 @@ tags:
 - attack.t1027
 - attack.execution
 - attack.t1059.001
+ruletype: SIGMA

rules/sigma/powershell/powershell_module/powershell_invoke_obfuscation_via_stdin.yml

@@ -27,3 +27,4 @@ tags:
 - attack.t1027
 - attack.execution
 - attack.t1059.001
+ruletype: SIGMA

rules/sigma/powershell/powershell_module/powershell_invoke_obfuscation_via_use_clip.yml

@@ -27,3 +27,4 @@ tags:
 - attack.t1027
 - attack.execution
 - attack.t1059.001
+ruletype: SIGMA

rules/sigma/powershell/powershell_module/powershell_invoke_obfuscation_via_use_mhsta.yml

@@ -27,3 +27,4 @@ tags:
 - attack.t1027
 - attack.execution
 - attack.t1059.001
+ruletype: SIGMA

rules/sigma/powershell/powershell_module/powershell_invoke_obfuscation_via_use_rundll32.yml

@@ -27,3 +27,4 @@ tags:
 - attack.t1027
 - attack.execution
 - attack.t1059.001
+ruletype: SIGMA

rules/sigma/powershell/powershell_module/powershell_invoke_obfuscation_via_var.yml

@@ -27,3 +27,4 @@ tags:
 - attack.t1027
 - attack.execution
 - attack.t1059.001
+ruletype: SIGMA

rules/sigma/powershell/powershell_module/powershell_powercat.yml

@@ -27,3 +27,4 @@ status: experimental
 tags:
 - attack.command_and_control
 - attack.t1095
+ruletype: SIGMA

rules/sigma/powershell/powershell_module/powershell_remote_powershell_session.yml

@@ -28,3 +28,4 @@ tags:
 - attack.lateral_movement
 - attack.t1021.006
 - attack.t1028
+ruletype: SIGMA

rules/sigma/powershell/powershell_module/powershell_susp_athremotefxvgpudisablementcommand.yml

@@ -35,3 +35,4 @@ status: experimental
 tags:
 - attack.defense_evasion
 - attack.t1218
+ruletype: SIGMA

rules/sigma/powershell/powershell_module/powershell_susp_zip_compress.yml

@@ -32,3 +32,4 @@ status: experimental
 tags:
 - attack.collection
 - attack.t1074.001
+ruletype: SIGMA

rules/sigma/powershell/powershell_module/powershell_suspicious_download_in_contextinfo.yml

@@ -27,3 +27,4 @@ tags:
 - attack.execution
 - attack.t1059.001
 - attack.t1086
+ruletype: SIGMA

rules/sigma/powershell/powershell_module/powershell_suspicious_invocation_generic_in_contextinfo.yml

@@ -35,3 +35,4 @@ tags:
 - attack.execution
 - attack.t1059.001
 - attack.t1086
+ruletype: SIGMA

rules/sigma/powershell/powershell_module/powershell_suspicious_invocation_specific_in_contextinfo.yml

@@ -92,3 +92,4 @@ tags:
 - attack.execution
 - attack.t1059.001
 - attack.t1086
+ruletype: SIGMA

rules/sigma/powershell/powershell_module/powershell_syncappvpublishingserver_exe_in_contextinfo.yml

@@ -27,3 +27,4 @@ status: experimental
 tags:
 - attack.defense_evasion
 - attack.t1218
+ruletype: SIGMA