Add CVE-2025-24054 Library-MS creation rule

[gkazimiarovich]

Summary of the Pull Request

Adds a new emerging-threats rule that detects the creation or extraction of a
malicious .library-ms file used to exploit CVE-2025-24054 (forced NTLM hash leak via Windows Explorer).
The rule targets Sysmon file-event telemetry and raises a medium-severity alert.

Changelog

new: Library-MS File Written (CVE-2025-24054 Exploit)

Example Log Event

Fixed Issues

SigmaHQ Rule Creation Conventions

• If your PR adds new rules, please consider following and applying these conventions

[github-actions]

Welcome @gkazimiarovich 👋

It looks like this is your first pull request on the Sigma rules repository!

Please make sure to read the SigmaHQ conventions document to make sure your contribution is adhering to best practices and has all the necessary elements in place for a successful approval.

Thanks again, and welcome to the Sigma community! 😃

[gkazimiarovich]

Bump.
What's the process to merge this rule to master?

[phantinuss]

There's some backlog, sorry. As a first time contributor the workflows won't run automatically. The first step is to look at the output of the failed tests and try to fix them. In general it helps reading the convention documents given in the PR template. If you need assistance with fixing the issues in the failed tests, please let me know.