Adding 4 rules from MITRE's Center for Threat Informed Defense

[RobertSchull]

Summary of the Pull Request

Summiting the Pyramid is a project from MITRE's Center for Threat Informed Defense and during the course of our research we developed a few analytics that we wanted to make them more accessible.
link to project page: https://center-for-threat-informed-defense.github.io/summiting-the-pyramid/overview/

Changelog

new: Service Registry Key Read Access Request
new: Scheduled Task Created - FileCreation
new: Scheduled Task Created - Registry

Example Log Event

Fixed Issues

SigmaHQ Rule Creation Conventions

• If your PR adds new rules, please consider following and applying these conventions

[nasbench]

Thanks for the submission @RobertSchull. I've made some changes to the rules so that they conform to the Sigma HQ standard. 2 main changes are below

• Deleted the Adfind rule as its covered already here https://github.com/SigmaHQ/sigma/blob/2a463fb7ea43e39a76960a745b72aa27618af9fa/rules/windows/process_creation/proc_creation_win_pua_adfind_susp_usage.yml
• I reduced the level of the other rules to low as they are more common and will produce a lot of events.