Add Deno child process and non-mail IMAP detections

[anpa1200]

Summary of the Pull Request

Adds two behavior-focused Windows detection rules derived from public reporting on Iranian threat activity:

• Suspicious shell or script interpreter execution spawned by the Deno runtime
• Non-mail-client processes establishing IMAP/IMAPS connections

Both rules are behavior-oriented, include public primary/vendor references, and document expected false positives.

Changelog

new: Deno Runtime Spawns Shell Or Scripting Interpreter
new: Non-Mail Client IMAP Connection Hunt Starter

Example Log Event

Not applicable; new rules.

Fixed Issues

None.

SigmaHQ Rule Creation Conventions

Validated locally with:

• python tests/test_logsource.py
• python tests/test_rules.py

[github-actions]

Welcome @anpa1200 👋

It looks like this is your first pull request on the Sigma rules repository!

Please make sure to read the SigmaHQ conventions to make sure your contribution is adhering to best practices and has all the necessary elements in place for a successful approval.

Thanks again, and welcome to the Sigma community! 😃

If you want to engage more with the community for official support, general discussions or announcements:

👉 Join our Discord server