[New Rule] Suspicious Content Extracted or Decompressed via Built-In Utilities

## Description

Identifies when suspicious content is extracted from a file and subsequently decompressed using the funzip utility.
Malware may execute the tail utility using the "-c" option to read a sequence of bytes from the end of a file. The
output from tail can be piped to funzip in order to decompress malicious code before it is executed. This behavior is
consistent with malware families such as Bundlore.

### Target indexes

logs-*

### Target Operating Systems

macOS

### Tested ECS Version
1.11.0

### Query
```sql
process where event.type == "start" and event.action == "exec" and
(process.args : "tail" and process.args : "-c" and process.args : "funzip")
```

### References
https://attack.mitre.org/software/S0482/
https://github.com/elastic/endpoint-rules/blob/c3d745dded34ff824a5a16b1c29ad4a4f9d260e7/rules/deprecated/execution_suspicious_content_extracted_or_decompressed_via_builtin_utilities.toml#L11