fix: FPs with WerFault

[Neo23x0]

Summary of the Pull Request

Fix FPs with WerFault rule

Changelog

fix: Creation of WerFault.exe/Wer.dll in Unusual Folder - Add filter for windows update/installation folder C:\Windows\SoftwareDistribution\

Example Log Event

    EventID: 11 
    Provider_Name: Microsoft-Windows-Sysmon 
    Provider_Guid: {5770385F-C22A-43E0-BF4C-06F5698FFBD9} 
    Version: 2 
    Level: 4 
    Task: 11 
    Opcode: 0 
    Keywords: 0 
    TimeCreated_SystemTime: 2024-11-04T09:20:46.8645257Z 
    EventRecordID: 17016270 
    Correlation_ActivityID:  
    Execution_ProcessID: 2116 
    Execution_ThreadID: 3088 
    Channel: Microsoft-Windows-Sysmon/Operational 
    Computer: win-2k16-s1.XXXXXXXXX
    Security_UserID: S-1-5-18 
    RuleName: - 
    UtcTime: 2024-11-04 09:20:46.855 
    ProcessGuid: {9AD9F73F-8C47-6728-0F00-000000004D00} 
    ProcessId: 896 
    Image: C:\Windows\system32\svchost.exe 
    TargetFilename: C:\Windows\SoftwareDistribution\Download\bbbfe6bf8f5102dafcbc90e7e65e7f4d\amd64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.14393.7254_none_e5bdda7797614c36\WerFault.exe 
    CreationUtcTime: 2024-11-04 09:20:46.855 
    User: NT AUTHORITY\SYSTEM

Fixed Issues

SigmaHQ Rule Creation Conventions

• If your PR adds new rules, please consider following and applying these conventions