Feature/rm submodule (#312)

* rm: submodule

* Add: rules

* Fix: hayabusa-rules to c9c10a

rules/sigma/process_creation/win_bootconf_mod.yml

@@ -0,0 +1,43 @@
+
+title: Modification of Boot Configuration
+ruletype: Sigma
+author: E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community
+date: 2019/10/24
+description: Identifies use of the bcdedit command to delete boot configuration data.
+  This tactic is sometimes used as by malware or an attacker as a destructive technique.
+detection:
+  SELECTION_1:
+    EventID: 1
+  SELECTION_2:
+    Image: '*\bcdedit.exe'
+  SELECTION_3:
+    CommandLine: '*set*'
+  SELECTION_4:
+    CommandLine: '*bootstatuspolicy*'
+  SELECTION_5:
+    CommandLine: '*ignoreallfailures*'
+  SELECTION_6:
+    CommandLine: '*recoveryenabled*'
+  SELECTION_7:
+    CommandLine: '*no*'
+  condition: (SELECTION_1 and (SELECTION_2 and SELECTION_3) and ((SELECTION_4 and
+    SELECTION_5) or (SELECTION_6 and SELECTION_7)))
+falsepositives:
+- Unlikely
+fields:
+- ComputerName
+- User
+- CommandLine
+id: 1444443e-6757-43e4-9ea4-c8fc705f79a2
+level: high
+logsource:
+  category: process_creation
+  product: windows
+modified: 2021/11/27
+references:
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md
+- https://eqllib.readthedocs.io/en/latest/analytics/c4732632-9c1d-4980-9fa8-1d98c93f918e.html
+status: test
+tags:
+- attack.impact
+- attack.t1490