Feature/rm submodule (#312)

* rm: submodule

* Add: rules

* Fix: hayabusa-rules to c9c10a

rules/sigma/powershell/powershell_script/powershell_wmimplant.yml

@@ -0,0 +1,45 @@
+
+title: WMImplant Hack Tool
+ruletype: Sigma
+author: NVISO
+date: 2020/03/26
+description: Detects parameters used by WMImplant
+detection:
+  SELECTION_1:
+    ScriptBlockText:
+    - '*WMImplant*'
+    - '* change_user *'
+    - '* gen_cli *'
+    - '* command_exec *'
+    - '* disable_wdigest *'
+    - '* disable_winrm *'
+    - '* enable_wdigest *'
+    - '* enable_winrm *'
+    - '* registry_mod *'
+    - '* remote_posh *'
+    - '* sched_job *'
+    - '* service_mod *'
+    - '* process_kill *'
+    - '* active_users *'
+    - '* basic_info *'
+    - '* power_off *'
+    - '* vacant_system *'
+    - '* logon_events *'
+  condition: SELECTION_1
+falsepositives:
+- Administrative scripts that use the same keywords.
+id: 8028c2c3-e25a-46e3-827f-bbb5abf181d7
+level: high
+logsource:
+  category: ps_script
+  definition: Script block logging must be enabled
+  product: windows
+modified: 2021/10/16
+references:
+- https://github.com/FortyNorthSecurity/WMImplant
+status: experimental
+tags:
+- attack.execution
+- attack.t1047
+- attack.t1059.001
+- attack.t1086