fix: NSIS install using $TEMP are flags matching rules

[Ti-R]

Summary of the Pull Request

NSIS install using $TEMP are flags matching rules

Changelog

Example Log Event

eg:
https://www.virustotal.com/gui/file/2ed7c8bbdb728a53354849f2801a05dd9719ffe7984002d0cc1dbc5c17696b66 Matches rule Suspicious Volume Shadow Copy Vsstrace.dll Load by frack113 at Sigma Integrated Rule Set (GitHub)

Fixed Issues

NSIS $TEMP is used like this:

'$TEMP\vc_redist.x64.exe /install /quiet /norestart'

Ideally, the exe to install should be signed by Microsoft from theses directories. So the rule should check if it is signed from Microsoft.

SigmaHQ Rule Creation Conventions

• If your PR adds new rules, please consider following and applying these conventions

[github-actions]

Welcome @Ti-R 👋

It looks like this is your first pull request on the Sigma rules repository!

Please make sure to read the SigmaHQ conventions document to make sure your contribution is adhering to best practices and has all the necessary elements in place for a successful approval.

Thanks again, and welcome to the Sigma community! 😃

[frack113]

Hi,
the rule match on C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe
It is Microsoft Visual C++ 2015-2022 Redistributable (x64) - 64 - 14.42.34433
Find {e7802eac-3305-4da0-9378-e55d1ed05518} - 32 - 14.42.34433
And there must be many other ...

To be more accurate, we can add a filter like this one:

filter_vc_redist:
   Image|startwith: 'C:\ProgramData\Package Cache\{'
   Image|endswith: '}\VC_redist.x64.exe' # need the 86 name too :)

[Ti-R]

Hi,
They can have several names.
eg: https://gist.github.com/opentechnologist/0fa93f92d4c42535bb8cbe539e36c080
vc_redist.x64.exe
vc_redist.x86.exe
vcredist_x64.exe
vcredist_x86.exe
And so on..
That's why I've set up more general rules for deployment on 'C:\ProgramData\Package Cache{'
If it is ok with the general rule (we can imagine other legit installer deployed from this source too with other names) like inside
'C:\Windows\Temp{' # Installers
I think we can merge like this if it is ok with you?