[Rule Idea] - SWIFT information harvesting

Nobody has claimed this yet.

## Prerequisites

* [x] Put an X between the brackets on this line if you have done all of the following:
* Checked that your rule idea isn't already filed: [search](https://github.com/fireeye/capa-rules/issues?q=is%3Aissue+is%3Aopen+)

## Summary
Similar to other collection rules , look for SWIFT information targeting.

## Examples
DYEPACK sample `4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a`

## Features
The malware in will craft sql statements looking for SWIFT related information.

Some examples:
```sql
SELECT MESG_S_UMID FROM SAAOWNER.MESG_%s WHERE MESG_SENDER_SWIFT_ADDRESS LIKE '%%%s%%' AND MESG_TRN_REF LIKE '%%%s%%';
```
```sql
DELETE FROM SAAOWNER.MESG_%s WHERE MESG_S_UMID = '%s';
```
```sql
DELETE FROM SAAOWNER.TEXT_%s WHERE TEXT_S_UMID = '%s';
```
```sql
SELECT * FROM (SELECT JRNL_DISPLAY_TEXT, JRNL_DATE_TIME FROM SAAOWNER.JRNL_%s WHERE JRNL_DISPLAY_TEXT LIKE '%%LT BBHOBDDHA: Log%%' ORDER BY JRNL_DATE_TIME DESC) A WHERE ROWNUM = 1;
```
```sql
SELECT MESG_FIN_CCY_AMOUNT FROM SAAOWNER.MESG_%s WHERE MESG_S_UMID = '%s';
```
```sql
SELECT MESG_S_UMID FROM SAAOWNER.MESG_%s WHERE MESG_SENDER_SWIFT_ADDRESS LIKE '%%%s%%' AND MESG_FIN_CCY_AMOUNT LIKE '%%%s%%';
```
```sql
UPDATE SAAOWNER.MESG_%s SET MESG_FIN_CCY_AMOUNT = '%s' WHERE MESG_S_UMID = '%s';
```
```sql
UPDATE SAAOWNER.TEXT_%s SET TEXT_DATA_BLOCK = UTL_RAW.CAST_TO_VARCHAR2('%s') WHERE TEXT_S_UMID = '%s';
```

## Additional context

## Rule details

### Namespace
`/collection/swift`

### References
- https://baesystemsai.blogspot.com/2016/04/two-bytes-to-951m.html

### Other rule meta information

Start by reviewing the listed DYEPACK sample and the SQL examples, then compare existing collection rules with the `/collection/swift` namespace. Done means the proposed rule captures the described SWIFT-related database activity and is supported by the provided sample.

Written by the indexing model from the issue text.