Add threat hunting rule for single-character binary execution

[norbert791]

Summary of the Pull Request

Detects execution of binaries with single-character names (e.g., r.exe, a.exe) which are commonly used by attackers to evade detection or as quick implants.

Reference: CERT Polska Energy Sector Incident Report 2025

Changelog

new: Single Character Binary Execution - Linux
new: Single Character Binary Execution - MacOS
new: Single Character Binary Execution - Windows

Example Log Event

Fixed Issues

SigmaHQ Rule Creation Conventions

• If your PR adds new rules, please consider following and applying these conventions

[kurtbruners]

Feels like this would generate a lot of noise for single-char executables and compilers as described by the developer.

Imo, since this tackles the tunneling actions done by the attackers in the polish incident, I would recommend to edit the or fine tune the existing SSH Tunneling or general tunneling rules with "-R" and Port being present in command line.

[norbert791]

The rule might be noisy in some environments, but I suppose it's not too much of a problem if it's a threat-hunting rule. To be frank, I think that 'one-char' software might appear less often than it may seem. I don't believe there's much legitimate software with 'one-char' binaries and if someone builds their own images, then they will probably give it a more descriptive name.