New command: stack-cmdlines

[YamatoSecurity]

stack-cmdlines: stack executed command lines

This command basically does this:

cat ../hayabusa/sample.jsonl|jq 'select(.EventID==1 or .EventID==4688) | .Details.Cmdline' -r | sort | uniq -c | sort -rn
1352 n/a
 652 "C:\Windows\system32\SearchFilterHost.exe" 0 520 524 532 65536 528"
 576 "C:\Program Files\Windows Media Player\wmpnscfg.exe"
 548 \??\C:\Windows\system32\conhost.exe 0xffffffff
 540 "C:\Windows\system32\cscript.exe" /nologo "MonitorKnowledgeDiscovery.vbs"
 492
 428 \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
 406 C:\Windows\system32\DllHost.exe /Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}
 340 "C:\Windows\system32\more.com"
 318 "C:\Windows\system32\SearchFilterHost.exe" 0 516 520 528 65536 524"
...

default output to stdout can be same as above with an option to save to a CSV file.
Also should include 2 options to filter out either Sysmon 1 logs (--ignoreSysmon) or Security 4688 logs (--ignoreSecurity).