Rod- Suspicious Local LLM Frameworks

[rosplk]

This PR introduces new analytics to detect Local LLM execution and shadow AI artifacts. Below is a breakdown of what was added.

New Analytics [3]

• LLM Model File Creation
• Local LLM Framework DNS Query
• Windows Local LLM Framework Execution

New Analytic Story [1]

• Suspicious Local LLM Frameworks

[nasbench]

Working on updating the detection to use CIM where possible.

[nasbench]

@rosplk @patel-bhavin made changes to the analytics so they are more CIM friendly and I merged some as they were overlapping. The coverage should be the same.

One is failing idk why and i cant see to find the data on Endor to check. So @patel-bhavin when you have some time to check it out,

[patel-bhavin]

@rosplk please avoid adding raw links in this format : https://raw.githubusercontent.com/splunk and .txt.

The preferred way is such that it is a GIT LFS file just like all other yamls -
https://media.githubusercontent.com/media/splunk/attack_data

Also, your current attack data size is 21k events for 2 detections: strongly consider shipping atomic datasets specific to the detection for future

Fixed that in here: splunk/attack_data#1096 .

Also, strongly encouraged to use DMs where feasible and if not use TA built extractions

@nasbench - Thank you for fixing up the detections to use TA fields 😸 I have pushed the remaining changes!