Add Sigma rule references to various LOLBAS (#260)

yml/OSBinaries/CustomShellHost.yml

@@ -15,6 +15,7 @@ Full_Path:
   - Path: C:\Windows\System32\CustomShellHost.exe
 Detection:
   - IOC: CustomShellHost.exe is unlikely to run on normal workstations
+  - Sigma: https://github.com/SigmaHQ/sigma/blob/ff5102832031425f6eed011dd3a2e62653008c94/rules/windows/process_creation/proc_creation_win_lolbin_customshellhost.yml
 Resources:
   - Link: https://twitter.com/YoSignals/status/1381353520088113154
   - Link: https://docs.microsoft.com/en-us/windows/configuration/kiosk-shelllauncher

yml/OSBinaries/DeviceCredentialDeployment.yml

@@ -15,6 +15,7 @@ Full_Path:
   - Path: C:\Windows\System32\DeviceCredentialDeployment.exe
 Detection:
   - IOC: DeviceCredentialDeployment.exe should not be run on a normal workstation
+  - Sigma: https://github.com/SigmaHQ/sigma/blob/ff5102832031425f6eed011dd3a2e62653008c94/rules/windows/process_creation/proc_creation_win_lolbin_device_credential_deployment.yml
 Acknowledgement:
   - Person: Elliot Killick
     Handle: '@elliotkillick'

yml/OSBinaries/OneDriveStandaloneUpdater.yml

@@ -16,6 +16,7 @@ Full_Path:
 Detection:
   - IOC: HKCU\Software\Microsoft\OneDrive\UpdateOfficeConfig\UpdateRingSettingURLFromOC being set to a suspicious non-Microsoft controlled URL
   - IOC: Reports of downloading from suspicious URLs in %localappdata%\OneDrive\setup\logs\StandaloneUpdate_*.log files
+  - Sigma: https://github.com/SigmaHQ/sigma/blob/ff5102832031425f6eed011dd3a2e62653008c94/rules/windows/registry/registry_set/registry_set_lolbin_onedrivestandaloneupdater.yml
 Resources:
   - Link: https://github.com/LOLBAS-Project/LOLBAS/pull/153
 Acknowledgement:

yml/OSBinaries/fsutil.yml

@@ -24,6 +24,7 @@ Full_Path:
 Detection:
   - IOC: fsutil.exe should not be run on a normal workstation
   - IOC: file setZeroData (not case-sensitive) in the process arguments
+  - Sigma: https://github.com/SigmaHQ/sigma/blob/ff5102832031425f6eed011dd3a2e62653008c94/rules/windows/process_creation/proc_creation_win_susp_fsutil_usage.yml
 Acknowledgement:
   - Person: Elliot Killick
     Handle: '@elliotkillick'

yml/OSScripts/Pubprn.yml

@@ -18,6 +18,7 @@ Code_Sample:
   - Code: https://raw.githubusercontent.com/LOLBAS-Project/LOLBAS/master/OSScripts/Payload/Pubprn_calc.sct
 Detection:
   - BlockRule: https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules
+  - Sigma: https://github.com/SigmaHQ/sigma/blob/ff5102832031425f6eed011dd3a2e62653008c94/rules/windows/process_creation/proc_creation_win_lolbin_pubprn.yml
 Resources:
   - Link: https://enigma0x3.net/2017/08/03/wsh-injection-a-case-study/
   - Link: https://www.slideshare.net/enigma0x3/windows-operating-system-archaeology