Clean up caldera's old collector logic

[RomuDeuxfois]

Description

For the OpenBAS implant we create just one signature: EXPECTATION_SIGNATURE_TYPE_PARENT_PROCESS_NAME.
And for Caldera implant we create multiple signatures depending on the payload type (command line, drop file, ect).

This leads us to maintain multiple detection strategies on the collectors side.
By aligning our methods, we can drastically simplify the code of our collectors and help community to develop new collector.

Should be done after this one -> #2339

[EllynBsc]

Hi @RomuDeuxfois 👋

I believe we can split this issue in 2 issues

• the first part is more of a technical improvement:

"For the OpenBAS implant we create just one signature: EXPECTATION_SIGNATURE_TYPE_PARENT_PROCESS_NAME.
And for Caldera implant we create multiple signatures depending on the payload type (command line, drop file, ect).

This leads us to maintain two ways of doing things on the Java side and to have multiple detection strategies on the collectors side.
By aligning our methods, we can also drastically simplify the code of our collectors and help community to develop new collector."

• the second part is a bug:

"Also, I guess we currently have detection issues with a caldera implant and Crowdstrike collector". Can you be more precise ?

WDYT ?

[RomuDeuxfois]

Ok for me @EllynBsc.

For the bug, I create this new issue -> #2339