Added new transformation for creating new fields from Hashes field

[slincoln-aiq]

Add HashesFieldsDetectionItemTransformation class

Description

This pull request introduces a new transformation class, HashesFieldsDetectionItemTransformation, to enhance the processing of hash values in Sigma rules. This transformation is designed to handle the 'Hashes' field more effectively by creating separate detection items for each hash type.

Features

• Transforms the generic 'Hashes' field into specific fields for each hash algorithm
• Supports various hash formats (e.g., 'ALGO=VALUE', 'ALGO|VALUE', or just 'VALUE')
• Auto-detects hash types based on their length
• Allows customization of field prefixes and the option to drop algorithm prefixes
• Handles multiple hash values within a single detection item

Implementation Details

• The transformation extends the DetectionItemTransformation class
• It processes each hash value, extracts the algorithm and value, and creates new detection items
• Supports common hash algorithms: MD5, SHA1, SHA256, and SHA512 (customizable)
• Provides flexibility in naming the resulting fields

Usage Example

Input Sigma rule:

selection:
  Hashes:
    - 'SHA1=5F1CBC3D99558307BC1250D084FA968521482025'
    - 'MD5=987B65CD9B9F4E9A1AFD8F8B48CF64A7'

->

selection:
  FileSHA1: '5F1CBC3D99558307BC1250D084FA968521482025'
  FileMD5: '987B65CD9B9F4E9A1AFD8F8B48CF64A7'

[thomaspatzke]

Cool, thanks for it!