Summary of Changes

Hello @bartblaze, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request introduces several important updates aimed at bolstering threat detection. It includes the addition of a new YARA rule to identify WebDAV usage in LNK files, significantly expands the lists of known URL shortener domains across multiple network signatures to better detect command-and-control channels, and adds a new signature to flag access to common password database files. These changes collectively enhance the system's ability to identify malicious activity related to shortcut files, suspicious network communications, and credential theft attempts.

Highlights

• New YARA Rule: A new YARA rule WebDAV_in_LNK has been added to detect WebDAV paths within LNK (shortcut) files, enhancing threat detection capabilities.
• Expanded URL Shortener Lists: The lists of recognized URL shortener domains have been significantly updated and expanded in both NetworkCnCHTTPSURLShortenerSite and NetworkDNSURLShortener signatures, improving detection of C2 communication and suspicious network activity.
• New Password Database Signature: A new signature ReadsPasswordDatabase has been introduced to identify when processes access files commonly associated with password databases (e.g., KeePass, 1Password, Enpass), aiding in credential access detection.
• Signature Refinements: Minor corrections were made to signature names and descriptions for improved accuracy and clarity, including fixing a typo and enhancing a description for Telegram exfiltration.