Added Sigma Rules

rules/Sigma/win_arbitrary_shell_execution_via_settingcontent.yml

@@ -0,0 +1,35 @@
+title: Arbitrary Shell Command Execution Via Settingcontent-Ms
+author: Sreeman
+date: 2020/03/13
+description: The .SettingContent-ms file type was introduced in Windows 10 and allows
+    a user to create "shortcuts" to various Windows 10 setting pages. These files
+    are simply XML and contain paths to various Windows 10 settings binaries.
+detection:
+    SELECTION_1:
+        CommandLine: '*.SettingContent-ms*'
+    SELECTION_2:
+        FilePath: '*immersivecontrolpanel*'
+    condition: (SELECTION_1 and  not (SELECTION_2))
+falsepositives:
+- unknown
+fields:
+- ParentProcess
+- CommandLine
+- ParentCommandLine
+id: 24de4f3b-804c-4165-b442-5a06a2302c7e
+level: medium
+logsource:
+    product: windows
+    service: security
+modified: 2021/08/09
+references:
+- https://posts.specterops.io/the-tale-of-settingcontent-ms-files-f1ea253e4d39
+tags:
+- attack.t1204
+- attack.t1193
+- attack.t1566.001
+- attack.execution
+- attack.initial_access
+yml_filename: win_arbitrary_shell_execution_via_settingcontent.yml
+yml_path: /Users/user/Documents/YamatoSecurity/sigma/rules/windows/builtin
+