add SuspDCSyncTraffic from MS Defender

[ruppde]

Cover MS Defender alert Behavior:Win32/SuspDCSyncTraffic.

Cover MS Defender alert Behavior:Win32/SuspDCSyncTraffic with string DCSync. It's kind of something different than all the other strings with malware names or categories, but it shows up in the same logs and is as critical, so why not just put it in here.

The screenshot is from pentesting with a Kali VM on a Windows host with MS Defender installed. It blamed vmnat.exe for the traffic coming out of the VM:

update: Antivirus Password Dumper Detection - add DCSync for MS Defender traffic detection

Fixed Issues

SigmaHQ Rule Creation Conventions

• If your PR adds new rules, please consider following and applying these conventions