Ignore rules that are causing Windows defender alerts

[YamatoSecurity]

There are a couple of rules that cause false positives with Windows defender so we would like to ignore them and not create them in the hayabusa-rules repository until we can create a fix with hayabusa to encrypt the rules and evade detection. @fukusuket Could I ask you to do this?

[fukusuket]

@YamatoSecurity Thank you for mention! Yes, I would love to implement it💪

[fukusuket]

sequence draft memo:

1. Execute sigma-to-hayabusa-converter.py
2. Unzip the hayabusa release binary
3. Replace rule
4. Run json-timeline -l -w -D -n -u -p super-verbose <- Is it possible in GitHub Actions with Admin permissions?
5. Check if there is a Defender detection rule in the JSON <- Is it possible in GitHub Actions?
6. If exists, remove the rule
7. Create a PR

[YamatoSecurity]

I was thinking about just manually ignoring the problem rules with the unique ID but we might be able to automate the anti-virus scan with this: https://learn.microsoft.com/en-us/azure/defender-for-cloud/github-action I am not sure if the Windows VM used for github actions has defender running in the background (i don't think so), so we wouldn't run hayabusa and check for defender alerts with a live scan, but just try to run a defender anti malware check against the converted sigma yml files.

[fukusuket]

@YamatoSecurity Sorry, I misunderstood! First I'll implement a process that just ignores specific UUIDs💪

[fukusuket]

Original issue:

• https://github.com/Yamato-Security/hayabusa/issues/1356
• https://github.com/Yamato-Security/hayabusa-rules/blob/main/sigma/builtin/powershell/powershell_script/posh_ps_tamper_windows_defender_set_mp.yml
• https://github.com/SigmaHQ/sigma/blob/06eaf2c1de673613a742bc6227caefb1dd19c31e/rules/windows/powershell/powershell_classic/posh_pc_tamper_windows_defender_set_mp.yml

[fukusuket]

I created following PR in sigma-to-hayabusa-converter repo. https://github.com/Yamato-Security/sigma-to-hayabusa-converter/pull/1

[fukusuket]

@YamatoSecurity After merging following PRs, A PR excluding ec19ebab-72dc-40e1-9728-4c0b805d722c will be created in the regular scheduled execution :)

• https://github.com/Yamato-Security/sigma-to-hayabusa-converter/pull/1
• https://github.com/Yamato-Security/hayabusa-rules/pull/674