Detect Cuckoo SandBox

Nobody has claimed this yet.

## Summary

Modify and add new rules to `anti-analysis/anti-vm/vm-detection` to detect sandboxes detection/evasion focusing on techniques used to detect/evade Cuckoo.

## Possible test samples

Publicly available samples that may contain the capability this rule should detect (MD5 hashes):
- 4d7420cc69753f31a946a4e86db0b2ca
- fccaaab898715da863f24ba4a15656e8
- d8a06811385e0fd463f215a43b366169

## References

Links or references to additional information on the capability (can also be included in the rule):

- https://cuckoosandbox.org/
- https://www.ptsecurity.com/ww-en/analytics/antisandbox-techniques
- https://blog.checkpoint.com/wp-content/uploads/2016/10/DefeatingSandBoxEvasion-VB2016_CheckPoint.pdf

## Namespace

Proposed namespace: `anti-analysis/anti-vm/vm-detection`. More details in https://github.com/fireeye/capa-rules/blob/master/doc/format.md#rule-namespace

## att&ck

`aka.mitre.att&ck.t1497.001`

Start by reading the existing rules under anti-analysis/anti-vm/vm-detection and the rule format documentation linked in the issue. Review the listed sample hashes and the Cuckoo and anti-sandbox references to identify the intended detection behavior. Done means adding or modifying rules in the proposed namespace with coverage for the relevant Cuckoo sandbox detection or evasion techniques.

Written by the indexing model from the issue text.