Add rule docs for 8.3 rule changes

[terrancedejesus]

Security Doc updates for rule changes in 8.3.

🚨 Security content review from the following PRs have made their way into these security docs for this release so the rules listed below should not need much review if any at all.

PRs:

• [Security Content] 8.3 Add Investigation Guides - 3 detection-rules#1990
• [Security Content] 8.3 - Add Investigation Guides 2 detection-rules#1989
• [Security Content] 8.3 - Add Investigation Guides detection-rules#1937

Rule Names:

• Clearing Windows Console History
• Clearing Windows Event Log
• Windows Event Logs Cleared
• Disable Windows Event and Security Logs Using Built-in Tools
• Enable Host Network Discovery via Netsh
• Windows Firewall Disabled via PowerShell
• Execution of File Written or Modified by Microsoft Office
• Execution of File Written or Modified by PDF Reader
• Potential Lateral Tool Transfer via SMB Share (Renamed from: "Lateral Tool Transfer")
• Account configured with never Expiring Password
• Exporting Exchange Mailbox via PowerShell
• Suspicious Process from Conhost
• Windows Defender Disabled via Registry Modification
• Disabling Windows Defender Security Settings via PowerShell
• Microsoft Windows Defender Tampering
• Suspicious .NET Reflection via PowerShell
• PowerShell Suspicious Payload Encoded and Compressed
• Suspicious PDF Reader Child Process
• Suspicious PowerShell Engine ImageLoad
• Conhost Spawned By Suspicious Parent Process
• Enumeration of Administrator Accounts
• Account Discovery Command via SYSTEM Account (Also renames the file to match the new title)
• File and Directory Discovery
• Windows Network Enumeration
• Peripheral Device Discovery
• External IP Lookup from Non-Browser Process
• Enumeration of Privileged Local Groups Membership
• Remote System Discovery Commands
• Security Software Discovery using WMIC
• Whoami Process Activity

[w0rk3r]

LGTM