add: Linux Security Capability Set Via Setfattr Utility

[EzLucky]

Summary of the Pull Request

Add a Linux rule to detect the use of Setfattr utility to modify security capabilities of a file.
It is a less known alternative to the Setcap utility (see this PR).

Changelog

new: Linux Security Capability Set Via Setfattr Utility (rules/linux/process_creation/proc_creation_lnx_setfattr_sec_cap.yml)

Example Log Event

Testing command : setfattr -n security.capability -v "0sAQAAAoAAAAAAAAAAAAAAAAAAAAA=" /path/to/binary

Here 0sAQAAAoAAAAAAAAAAAAAAAAAAAAA= represents the specific b64 encoding for CAP_SETUID on my el8 system.

Example of auditd log :

type=EXECVE msg=audit([...]): argc=6 a0="setfattr" a1="-n" a2="security.capability" a3="-v" a4="0sAQAAAoAAAAAAAAAAAAAAAAAAAAA=" a5="/path/to/binary"

Fixed Issues

SigmaHQ Rule Creation Conventions

• If your PR adds new rules, please consider following and applying these conventions