[Enhancement] Add Script Entropy Fields to PowerShell events

[w0rk3r]

Proposed commit message

Adds powershell.file.script_block_entropy and powershell.file.script_block_entropy_normalized
fields computed at ingest time using Shannon entropy. These fields quantify the character-level
randomness of PowerShell script blocks to provide context that will be used in detection logic.

Summary

Related to https://github.com/elastic/ia-trade-team/issues/704

Adds powershell.file.script_block_entropy and powershell.file.script_block_entropy_normalized fields.

Inspired by: Painless Parsing: Shannon Entropy Calculation - Services

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

[elasticmachine]

Pinging @elastic/sec-windows-platform (Team:Security-Windows Platform)

[efd6]

Note that you can also calculate the entropy variance with very little extra work.

[elasticmachine]

💔 Build Failed

• Buildkite Build
• Commit: c239d0a

Failed CI Steps

• Check integrations windows

History

• 💔 Build #32939 failed 623eb8c
• 💔 Build #32921 failed d888514
• 💔 Build #32913 failed 9e5d642

cc @w0rk3r