Create IdatLoader.yaml (Velocidex#665)

Addint IDAT loader detection

https://www.rapid7.com/blog/post/2023/08/31/fake-update-utilizes-new-idat-loader-to-execute-stealc-and-lumma-infostealers/

content/exchange/artifacts/IdatLoader.yaml

@@ -0,0 +1,69 @@
+name: Windows.Detection.IdatLoader
+author: Matt Green - @mgreen27
+description: |
+  This artifact enables running Yara over processes in memory.
+  Targeting detection of IDAT Loader.  
+
+type: CLIENT
+reference:
+  - https://www.rapid7.com/blog/post/2023/08/31/fake-update-utilizes-new-idat-loader-to-execute-stealc-and-lumma-infostealers/
+
+parameters:
+  - name: ProcessRegex
+    default: .
+    type: regex
+  - name: PidRegex
+    default: .
+    type: regex
+  - name: UploadHits
+    type: bool
+  - name: YaraRule
+    type: yara
+    default: |
+        rule IDAT_Loader_August_2023
+        {
+            meta:
+                description = "IDAT Loader August 2023"
+                author = "Natalie Zargarov"
+            strings:
+                $trait_0 = {C6 A5 79 EA F4 B4 07 9A}
+                $trait_1 = {3D ED C0 D3}
+                $trait_2 = {C6 45 FC 4D C6 45 FD 5A}
+                $trait_3 = {68 77 94 91 2C 8B 45 ?? 50 E8}
+            condition:
+                2 of ($trait_*)
+        }
+
+  - name: NumberOfHits
+    description: THis artifact will stop by default at one hit. This setting allows additional hits
+    default: 1
+    type: int
+  - name: ContextBytes
+    description: Include this amount of bytes around hit as context.
+    default: 0
+    type: int64
+  - name: ExePathWhitelist
+    description: Regex of ProcessPaths to exclude
+    type: regex
+
+
+sources:
+  - precondition:
+      SELECT OS From info() where OS = 'windows'
+
+    query: |
+      SELECT Pid,ProcessName,ExePath,CommandLine,
+        Rule,Meta,YaraString,HitOffset, HitContext,
+        process_tracker_callchain(id=Pid).data as ProcessChain
+      FROM Artifact.Windows.Detection.Yara.Process(
+                PidRegex=PidRegex,
+                ProcessRegex=ProcessRegex,
+                YaraRule=YaraRule,
+                YaraRule=YaraRule,
+                NumberOfHits=NumberOfHits,
+                ContextBytes=ContextBytes,
+                ExePathWhitelist=ExePathWhitelist )
+
+column_types:
+  - name: HitContext
+    type: preview_upload