Add Correlation Support

[nasbench]

Summary of the Pull Request

This PR adds correlation support to this repo. AKA once this is merged correlation rules will be supported and allowed to be merged in SigmaHQ rules repo.

This PR will start by migrating some correlations that were submitted in the past as well as establishing the necessary conventions and standard.

There is a corresponding validator PR SigmaHQ/pySigma-validators-sigmaHQ#60 that has to be merged.

As well as a new sigmahq-convention for correlations. SigmaHQ/sigma-specification#196

Below is a list of old PRs and rules that shoule be migrated / investigated as part of this initial MVP

• Add correlation rules from AT project #5415
• Bitlocker_ltrm_com_hijacking #5729
• Okta MFA Fatigue #4308
• Create okta_detect_suspicious_push_challenge.yml #4238
• Create win_security_authentication_with_valid_users.yaml #4147
• azure_ad_password_spray_attempt_bypassingMFA.yml #4129

We also have rules written in the old notation sitting in the unspported folder. Frack already did some initial work last year. See below:

• https://github.com/frack113/MetaRuleBazar

Changelog

TBD

Example Log Event

N/A

Fixed Issues

N/A

SigmaHQ Rule Creation Conventions

• If your PR adds new rules, please consider following and applying these conventions