Not exposing which condition of the sigma rule is detected.

Example for this [rule](https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_malicious_commandlets.yml) ``` title: Malicious PowerShell Commandlets - ScriptBlock id: 89819aa4-bbd6-46bc-88ec-c7f7fe30efa6 ``` has a bunch of Commandlets ``` detection: selection: ScriptBlockText|contains: - 'Add-Exfiltration' - 'Add-Persistence' - 'Add-RegBackdoor' - 'Add-RemoteRegBackdoor' - 'Add-ScrnSaveBackdoor' - 'ConvertTo-Rc4ByteStream' - 'Decrypt-Hash' - 'Disable-ADIDNSNode' - 'Do-Exfiltration' - 'Enable-ADIDNSNode' - 'Enabled-DuplicateToken' - 'Exploit-Jboss' - 'Export-ADRCSV' - 'Export-ADRExcel' ecc. ``` it will be nice to see the exact commandlet that was detected. Right now, the sqlite query looks like this: ``` "SELECT * FROM logs WHERE (Channel='Microsoft-Windows-PowerShell/Operational' OR Channel='PowerShellCore/Operational') AND (EventID=4104 AND ((ScriptBlockText LIKE '%Add-Exfiltration%' ESCAPE '\\' OR ScriptBlockText LIKE '%Add-Persistence%' ESCAPE '\\' OR ScriptBlockText LIKE '%Add-RegBackdoor%' ESCAPE '\\' OR ScriptBlockText LIKE '%Add-RemoteRegBackdoor%' ESCAPE '\\' OR ScriptBlockText LIKE '%Add-ScrnSaveBackdoor%' ESCAPE '\\' OR ScriptBlockText LIKE '%ConvertTo-Rc4ByteStream%' ESCAPE '\\' OR ScriptBlockText LIKE '%Decrypt-Hash%' ESCAPE '\\' OR ScriptBlockText LIKE '%Disable-ADIDNSNode%' ESCAPE '\\' OR ScriptBlockText LIKE '%Do-Exfiltration%' ESCAPE '\\' OR ScriptBlockText LIKE '%Enable-ADIDNSNode%' ESCAPE '\\' OR ScriptBlockText LIKE '%Enabled-DuplicateToken%' ESCAPE '\\' OR ScriptBlockText LIKE '%Exploit-Jboss%' ESCAPE '\\' OR ScriptBlockText LIKE '%Export-ADRCSV%' ESCAPE '\\' OR ScriptBlockText LIKE '%Export-ADRExcel%' ecc. ``` and it doesn't expose which condition is detected.