[New Rule] Pre-OS Boot: Bootkit

## Description
New Rule for Pre-OS Boot: Bootkit.
Adversaries may use bootkits to persist on systems. Bootkits reside at a layer below the operating system and may make it difficult to perform full remediation unless an organization suspects one was used and can act accordingly. A bootkit is a malware variant that modifies the boot sectors of a hard drive, including the Master Boot Record (MBR) and Volume Boot Record (VBR).

This came about when in Endgame a prevent ransomware alert popped up in relation to MBR Overwrite event. However, this wasn't transmitted to Elastic Security and the Detection rules seem to miss this. The Detection rule in question "Ransomware - Prevented - Elastic Endgame".

field | value
------------ | -------------
endgame.command_line | "C:\Program Files\Dell\SARemediation\plugin\SOSInstallerTool.exe" /install "C:\WINDOWS\TEMP\launcher.serviceoscmd"
endgame.process_name | SOSInstallerTool.exe
endgame.process_path | C:\Program Files\Dell\SARemediation\plugin\SOSInstallerTool.exe

NOTE - noted that the SOSInstallerTool.exe is the Dell SupportAssist OS Recovery Plugin for Dell Update's primary executable file. This is the example and this is was made the alert in endgame fire but wasn't put across in the elastic security detection rule.

When looking against the cool tool (ATT&CK Navigator) there doesn't seem to be any detection rules that match.

## Required Info

### Target indexes
endgame-*

### Target Operating Systems
windows, linux

## Optional Info

Perform integrity checking on MBR and VBR. Take snapshots of MBR and VBR and compare against known good samples. Report changes to MBR and VBR as they occur for indicators of suspicious activity and further analysis.

### References
Pre-OS Boot: Bootkit
https://attack.mitre.org/techniques/T1542/003/

Pre-OS Boot
https://attack.mitre.org/techniques/T1542/