Added new tool for recording audio - ecasound

[CheraghiMilad]

Summary of the Pull Request

The Audio Capture technique detects attempts to record audio using the arecord and ecasound utilities. These tools are commonly used in Linux environments for audio recording and sound manipulation. arecord is a command-line utility for recording audio via ALSA (Advanced Linux Sound Architecture), while ecasound is an audio processing tool that provides advanced features for multi-track recording. Detection rules are based on monitoring for specific execution commands or system calls that involve these utilities.

Changelog

• update: Audio Capture - add ecasound detection

Example Log Event

{
  "type": "SYSCALL",
  "msg": "audit(1745697050.075:2344):",
  "arch": "c000003e",
  "syscall": 319,
  "success": "yes",
  "exit": 19,
  "a0": "7ffe5b4fdb40",
  "a1": 3,
  "a2": 0,
  "a3": 0,
  "items": 0,
  "ppid": 17756,
  "pid": 18259,
  "auid": 1000,
  "uid": 1000,
  "gid": 1000,
  "euid": 1000,
  "suid": 1000,
  "fsuid": 1000,
  "egid": 1000,
  "sgid": 1000,
  "fsgid": 1000,
  "tty": "pts3",
  "ses": 3,
  "comm": "ecasound",
  "exe": "/usr/bin/ecasound",
  "subj": "unconfined",
  "key": "anon_file_create"
}

Fixed Issues

SigmaHQ Rule Creation Conventions

• If your PR adds new rules, please consider following and applying these conventions

[frack113]

LGTM