Added new rule to detect suspicious file dump using print.exe

[Securityinbits]

Summary of the Pull Request

Added new rule Suspicious File Dump Via Print.EXE related to recent Solarwinds WHD active exploitation and observed in huntress blog

Changelog

new: Suspicious File Dump Via Print.EXE

Example Log Event

N/A

Fixed Issues

N/A

SigmaHQ Rule Creation Conventions

Used VS Code sigma plugin to write this new sigma rule

• If your PR adds new rules, please consider following and applying these conventions

[swachchhanda000]

Hi @Securityinbits,

Thanks for the PR.

The logic looks okay, i have only suggested some metadata changes. Please apply the changes while also fixing the failing pipeline. And if you don't know it already we recently introduced regression testing for our detection rules, and we rely on EVTX files to validate that rules correctly trigger on expected events. Thus, it would also be nice if you could provide us the EVTX file as well.

[Securityinbits]

Thank you @swachchhanda000 for the review and suggestions.

I was not aware of the EVTX file requirement. I will generate the Sysmon EVTX file and upload it here.

[Securityinbits]

@swachchhanda000 added Regression data with evtx , json and info.yml.

Please check and let me know if anything else needed.

[frack113]

LGTM
There shouldn't be any false positives that still use print.exe, right?