add SID version of integrity levels

[nasbench]

Summary of the Pull Request

Per issues #5105 this PR adds the SID version of integrity levels to cover log sources that report it in that way.

Changelog

chore: add SID version of IntegrityLevel
fix: Suspicious Process By Web Server Process - Fix typo in "ntdsutil" process name

Example Log Event

{"CommandLine":"C:\Windows\System32\ComputerDefaults.exe",
"CurrentDirectory":"",
"EventID":1,
"Event_Categories":["process_creation|_"],
"Event_Time":"2024-11-30T18:38:05.5688542+08:00",
"Event_Type":"procmonitor_process_creation",
"Hashes":"MD5=86BD981F55341273753AC42EA200A81E,SHA1=,SHA256=",
"Image":"C:\Windows\System32\ComputerDefaults.exe",
"ImageFileName":"ComputerDefaults.exe",
"IntegrityLevel":"S-1-16-12288",
"ParentCommandLine":"explorer.exe",
"ParentImage":"C:\Users\qy\Desktop\s2\Akagi64.exe",
"ParentProcessId":2228,
"ParentProcessKey":"2228_1732963021068",
"ParentUser":"STU1\qy",
"ProcImageUniqueKey":"C:\Windows\System32\ComputerDefaults.exe#37376#1247535541653",
"ProcStartTick":64,"ProcTreePathCommandLine":[""C:\Windows\System32\cmd.exe"","explorer.exe","C:\Windows\System32\ComputerDefaults.exe"],
"ProcTreePathImage":["C:\Windows\System32\cmd.exe","C:\Users\qy\Desktop\s2\Akagi64.exe","C:\Windows\System32\ComputerDefaults.exe"],
"ProcTreePathName":["cmd.exe","Akagi64.exe","ComputerDefaults.exe"],
"ProcTreePathStartPath":["C:\Users\qy\Desktop\s2","C:\Users\qy\Desktop\s2",""],
"ProcessId":2388,
"ProcessKey":"2388_1732963021115",
"ProcessName":"ComputerDefaults.exe",
"ProcessRoot":"cmd.exe_2868_1732963016538",
"ProcessStartTime":"2024-11-30 18:37:01",
"User":"STU1\qy",
"sigma_results":
[{"ID":"2d87d610-d760-45ee-a7e6-7a6f2a65de00","Title":"Mustang Panda Dropper","Level":"","Tags":["attack.t1587.001","attack.resource_development","detection.emerging_threats"],"Result":{"Match":true,"SearchResults":{"selection_cli":true,"selection_img":false},"MatchReasons":{"selection_cli":[{"Field":"CommandLine","Reasons":["contains|s"]}]},"ConditionResults":[true]}}]}

Fixed Issues

#5105

SigmaHQ Rule Creation Conventions

• If your PR adds new rules, please consider following and applying these conventions