sqltoolsps.exe usage detection added

rules/windows/process_creation/win_susp_use_of_sqltoolsps_bin.yml

@@ -0,0 +1,32 @@
+title: Detection of PowerShell Execution via SQL client tools
+id: a746c9b8-a2fb-4ee5-a428-92bee9e99060 
+status: experimental
+description: PowerShell execution through builtin SQL Server Management Studio "SQLToolsPS.exe" binary. Microsoft PS logging like
+  ScriptBlock logging function of PowerShell is not an option here, PS session caused by the binary won't be recorded/logged.
+references:
+  - https://github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OtherMSBinaries/Sqltoolsps.yml 
+  - https://twitter.com/pabraeken/status/993298228840992768 
+tags:
+    - attack.execution
+    - attack.t1059.001
+    - attack.defense_evasion 
+    - attack.t1127
+author: Agro (@agro_sev)
+date: 2020/10/12
+logsource:
+    category: process_creation
+    product: windows
+detection:
+    selection1:
+        Image|endswith: '\sqltoolsps.exe'
+    selection2:        
+        ParentImage|endswith: '\sqltoolsps.exe'
+    selection3:
+        OriginalFileName: '\sqltoolsps.exe'
+    reduction:
+        ParentImage|endswith: '\smss.exe'
+    condition: selection1 or selection2 or selection3 and not reduction
+falsepositives:
+    - Direct PS command execution through SQLToolsPS.exe is uncommon, childprocess sqltoolsps.exe spawned by  smss.exe is a legitimate action.
+level: medium 
+