Support expand modifiers

[YamatoSecurity]

contains|expand and expand are the last modifiers that are used by rules but are not supported.
This modifier is more difficult than the others because custom lists need to be created beforehand in order to use them.

Current list of expand possibilities:

Admins_Workstations
DC-MACHINE-NAME
Workstations
internal_domains
domain_controller_hostnames

Since these lists will need to be created on the user's end, I want to place them in the ./config/expand/ directory instead of ./rules/config/expand as we will not need to dynamically upload them.

Example rule:

detection:
    selection:
        EventID: 5145
        RelativeTargetName|contains: '\winreg'
    filter_main:
        IpAddress|expand: '%Admins_Workstations%'
    condition: selection and not filter_main

If the ./config/expand/Admins_Workstations.txt file exists, then Hayabusa will replace the placeholder %Admins_Workstations% with every string inside this text file. There can be multiple values inside the text file, so for example if there are 5 admin workstation names in the text file, then essentially Hayabusa will use 5 different variations of this rule.

For example, it will essentially check the same logic as:

- IpAddress: 'AdminWorkstation1'
- IpAddress: 'AdminWorkstation2'
- IpAddress: 'AdminWorkstation3'
- IpAddress: 'AdminWorkstation4'
- IpAddress: 'AdminWorkstation5'

As of now, the only variation of expand is contains|expand but we should also probably support startswith|expand and endswith|expand as well.

If ./config/expand/Admins_Workstations.txt does NOT exist, then Hayabusa will just ignore this rule.

We should add the number of loaded "expand rules":

Loading detection rules. Please wait.

Excluded rules: 26
Noisy rules: 12 (Disabled)

Deprecated rules: 214 (4.96%) (Disabled)
Experimental rules: 375 (8.70%)
Stable rules: 241 (5.59%)
Test rules: 3,696 (85.71%)
Unsupported rules: 42 (0.97%) (Disabled)

Correlation rules: 3 (0.07%)
Correlation referenced rules: 3 (0.07%)

Expand rules: 8 (0.07%)
Enabled expand rules: 0 (0%)

Hayabusa rules: 175
Sigma rules: 4,137
Total detection rules: 4,312

By default, since the expand config files need to be created, there should be 0 enabled expand rules.

I am thinking about creating 2 expand commands: One to list up the expand placeholder names and one to create lists to use in the expand config files. I will create separate issues for these.

@fukusuket This one is a little difficult, but do you think you could do this one?

[fukusuket]

I see, that sounds a bit difficult!🤣 I'll try to implement it!💪