feat: Add some rules to detect Conti behaviour

Add rules based on the leaks from the Conti group to detect
malicious behaviour.

rules/windows/powershell/powershell_shellintel_malicious_commandlets.yml

@@ -0,0 +1,27 @@
+title: Malicious ShellIntel PowerShell Commandlets
+id: 402e1e1d-ad59-47b6-bf80-1ee44985b3a7
+status: experimental
+description: Detects Commandlet names from ShellIntel exploitation scripts.
+date: 2021/08/09
+references:
+    - https://github.com/Shellntel/scripts/
+tags:
+    - attack.execution
+    - attack.t1059.001
+author: Max Altgelt, Tobias Michalski
+logsource:
+    product: windows
+    service: powershell
+    definition: It is recommended to use the new "Script Block Logging" of PowerShell v5.
+detection:
+  selection:
+      EventID: 4104
+      ScriptBlockText:
+        - Invoke-SMBAutoBrute
+        - Invoke-GPOLinks
+        - Out-Minidump
+        - Invoke-Potato
+  condition: selection
+falsepositives:
+    - Unknown
+level: high