Update the detection logic of Suspicious Start-Process PassThru and added the alias saps

[eriknordstrm]

Summary of the Pull Request

This pull request updates Suspicious Start-Process PassThru, adding the Start-Process alias saps.
Reference: https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/start-process?view=powershell-7.6

Changelog

fix: Added the alias saps to Suspicious Start-Process PassThru.
update: Altered the detection logic of Suspicious Start-Process PassThru to split the cmdlet and parameters.

Example Log Event

Fixed Issues

SigmaHQ Rule Creation Conventions

• If your PR adds new rules, please consider following and applying these conventions

[github-actions]

Welcome 👋

It looks like this is your first pull request on the Sigma rules repository!

Please make sure to read the SigmaHQ conventions to make sure your contribution is adhering to best practices and has all the necessary elements in place for a successful approval.

Thanks again, and welcome to the Sigma community! 😃

[swachchhanda000]

Looks good overall.
Small concern on saps specifically: since ScriptBlockText|contains is substring-based and I have a small doubt whether saps will match as substring of a larger stringtext. @nasbench, Please share your two cents on this??