Veeam get creds

[swachchhanda000]

Summary of the Pull Request

Veeam-Get-Creds.ps1 script added as a malicious script

Changelog

update: Malicious PowerShell Scripts - FileCreation
update: Malicious PowerShell Scripts - PoshModule
update: Malicious PowerShell Commandlets - PoshModule
update: Malicious PowerShell Commandlets - ProcessCreation

Example Log Event

Various Threat Actors have been observed abusing this script for password extraction from database
Reference:

1. https://www.sygnia.co/blog/abyss-locker-ransomware-attack-analysis/
2. https://thedfirreport.com/2024/12/02/the-curious-case-of-an-egg-cellent-resume/

Fixed Issues

SigmaHQ Rule Creation Conventions

• If your PR adds new rules, please consider following and applying these conventions