[Enhancement] Add Entropy Enrichments to PowerShell events

[w0rk3r]

Proposed commit message

Adds powershell.file.script_block_entropy_bits and powershell.file.script_block_surprisal_sd
fields computed at ingest time using Shannon entropy over Unicode characters. These fields
quantify character-level randomness and distribution uniformity of PowerShell script blocks
to provide context for obfuscation detection. Also adds script_block_length and
script_block_unique_symbols for enrichment analysis.

Summary

Related to https://github.com/elastic/ia-trade-team/issues/704

Adds four fields for script analysis at ingest time:

• script_block_entropy_bits: Shannon entropy (0-20 bits) measuring randomness
• script_block_surprisal_sd: Distribution uniformity of characters
• script_block_length: Total character count
• script_block_unique_symbols: Distinct character count

These fields help us improve and tune PowerShell obfuscation detections by providing additional context about the scripts content.

Inspired by: Painless Parsing: Shannon Entropy Calculation - Services

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

[elasticmachine]

Pinging @elastic/sec-windows-platform (Team:Security-Windows Platform)

[efd6]

Note that you can also calculate the entropy variance with very little extra work.

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

[efd6]

LGTM after nits (but not a code owner).

[elasticmachine]

Pinging @elastic/elastic-agent-data-plane (Team:Elastic-Agent-Data-Plane)

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: 6d331b7

History

• 💚 Build #33349 succeeded 2052ec7
• 💚 Build #33345 succeeded a2f002a
• 💚 Build #33319 succeeded 55404d4
• 💔 Build #33317 failed b339352
• 💔 Build #33316 failed 13c32b3
• 💔 Build #33315 failed 8a817d2

cc @w0rk3r

[elastic-vault-github-plugin-prod]

Package windows - 3.1.3 containing this change is available at https://epr.elastic.co/package/windows/3.1.3/