Feature/rm submodule (#312)

* rm: submodule

* Add: rules

* Fix: hayabusa-rules to c9c10a

rules/sigma/process_creation/win_hack_secutyxploded.yml

@@ -0,0 +1,33 @@
+
+title: SecurityXploded Tool
+ruletype: Sigma
+author: Florian Roth
+date: 2018/12/19
+description: Detects the execution of SecurityXploded Tools
+detection:
+  SELECTION_1:
+    EventID: 1
+  SELECTION_2:
+    Company: SecurityXploded
+  SELECTION_3:
+    Image: '*PasswordDump.exe'
+  SELECTION_4:
+    OriginalFileName: '*PasswordDump.exe'
+  condition: (SELECTION_1 and (SELECTION_2 or SELECTION_3 or SELECTION_4))
+falsepositives:
+- unlikely
+id: 7679d464-4f74-45e2-9e01-ac66c5eb041a
+level: critical
+logsource:
+  category: process_creation
+  product: windows
+modified: 2021/05/11
+references:
+- https://securityxploded.com/
+- https://cyberx-labs.com/blog/gangnam-industrial-style-apt-campaign-targets-korean-industrial-companies/
+status: experimental
+tags:
+- attack.credential_access
+- attack.t1555
+- attack.t1003
+- attack.t1503