Hunting rules for Hex Staging Attack and HTML Phishing Attachment

[skaynum]

Summary of the Pull Request

This pull requests contains new rules that detect the below:

• Potential HTML Phishing Attachment campaigns
  

• Potential Hex Staging Attack, that stages malicious payloads as detected in espionage campaigns in South East Asia.
  

Changelog

new: Potential Hex Staging Attack
new: Potential HTML Phishing Attachment Clicked

Example Log Event

Potential Hex Staging Attack sample event:
C:\windows\system32\cmd.exe /c >> C:\Users\test\malware.exe.tmp set /p="hex coded payload"

Potential HTML Phishing Attachment Clicked sample event
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\admin\Documents\MD564BJUY.htm

Fixed Issues

SigmaHQ Rule Creation Conventions

• If your PR adds new rules, please consider following and applying these conventions

[skaynum]

Changes made.