Documentation for yara rules about red_team_tool_countermeasures

[williballenthin]

The only field you should rely upon is the description field (and author but that always "FireEye"). The remainder are primarily used for correlating with some of our internal resources, so we can do things like push updates in the right order. I understand that the md5 field looks pretty juicy; however, as described in #3, they often correspond to custom internal builds of the red team tools, and therefore are unlikely to be of much use.

Really, we should probably strip all these other fields out, and we may do that in a future release, so I'd discourage you from attaching any meaning to these other metadata fields.