Driver and DLL fields

[rw-access]

Endgame and Sysmon both collect events for loaded DLLs and drivers within Windows. I think this is fairly standard, and posix also has concepts of kernel modules and process modules. There's plenty of wiggle room with the name of this field set. module, library, dll, lib, etc. I see pros and cons of each, so we may need a vote.

Here are some of the fields that are needed

• name - analogous to process.name, the name of the file
• path - analogous to process.path, path to the file
• hash - nested fieldset
• pe - if we have a field set, this could be nested here as well

[dcode]

@rw-access do you have a sample event that includes this data from endgame, sysmon, and maybe others? I think it's important that we abstract out commonalities across file types.