Add rule for detecting hiding shutdown actions

[Still34]

Summary

This PR adds a rule that detects registry values related to hiding shutdown actions (i.e., logout, shutdown, reboot, etc.), specifically ones using policy registry values. This is often abused by ransomware to prevent mid-encryption-shutdowns.

[Still34]

Let me know if this looks okay. I've opted to use case insensitive regex instead of substrings. If all looks good, I'll open a PR on the test data repo.

[williballenthin]

rule logic looks good 👍

i'm not familiar with this technique though i can kinda guess about it based on the key names. are you able to find a reference or two that i could use to learn more (and we can include in the meta block)?

[Still34]

Roughly what it may look like in some ransomware; this specific one was Mallox/TargetCompany.

[mr-tz]

I agree on the reference, this appears to be one: https://securelist.com/mallox-ransomware/113529/

[mr-tz]

thank you!