extend rule features and rename

[mr-tz]

closes #966

[mr-tz]

@Ezbeat @jtothej please take a look

[Ezbeat]

Thank you for taking my feedback into consideration.

1. Regarding the ProcessSignaturePolicy configuration, wouldn't it be clearer and more consistent to use policy.MicrosoftSignedOnly instead of policy.flags? This would enhance readability and align with the explicit naming convention used in other mitigation policies.

2. For the detection of blockdlls, rather than relying on the InitializeProcThreadAttributeList function, how about using the UpdateProcThreadAttribute function? This approach could directly focus on when the Attribute is actually set, potentially improving accuracy and reducing false positives.

[mr-tz]

nice, great feedback here, thanks! does the rule now look good to you?

[Ezbeat]

Looks good. Thank you for considering the suggestions!

Additionally, after reviewing the rules, it seems that the blockdlls condition overlaps with the rule defined in:

protect-spawned-processes-with-mitigation-policies.yml

What are your thoughts on this? If there is indeed an overlap, we could consider removing the blockdlls condition from this rule to avoid redundancy.

[mr-tz]

Oh 🤦 @jtothej already did all the work... Thanks, for noticing. I'll update accordingly.

[mr-tz]

Thanks, @Ezbeat (and @jtothej)!!