Sysinternals: add ARM64 (*64a.exe) binary coverage

[einlamye]

Summary of the Pull Request

Sysinternals now ships native ARM64 builds that use the 64a suffix (e.g. procexp64a.exe, Sysmon64a.exe, handle64a.exe, procdump64a.exe). The existing rules only matched the x86/x64 names, leaving a blind spot on ARM64 Windows hosts. This PR adds the corresponding *64a.exe value next to every existing *64.exe entry across the affected rules. Detection-equivalent change only — no logic, condition or field changes.

Changelog

update: Amsi.DLL Load By Uncommon Process - add ARM64 (*64a.exe) variant
update: WMI Module Loaded By Uncommon Process - add ARM64 (*64a.exe) variant
update: Potentially Suspicious AccessMask Requested From LSASS - add ARM64 (*64a.exe) variant
update: Potential Privileged System Service Operation - SeLoadDriverPrivilege - add ARM64 (*64a.exe) variant
update: Suspicious PROCEXP152.sys File Created In TMP - add ARM64 (*64a.exe) variant
update: Process Explorer Driver Creation By Non-Sysinternals Binary - add ARM64 (*64a.exe) variant
update: Process Monitor Driver Creation By Non-Sysinternals Binary - add ARM64 (*64a.exe) variant
update: CredUI.DLL Loaded By Uncommon Process - add ARM64 (*64a.exe) variant
update: HackTool - SysmonEnte Execution - add ARM64 (*64a.exe) variant
update: Potential Credential Dumping Activity Via LSASS - add ARM64 (*64a.exe) variant
update: Potentially Suspicious GrantedAccess Flags On LSASS - add ARM64 (*64a.exe) variant
update: Potential Defense Evasion Via Rename Of Highly Relevant Binaries - add ARM64 (*64a.exe) variant
update: Renamed ProcDump Execution - add ARM64 (*64a.exe) variant
update: Renamed Sysinternals Sdelete Execution - add ARM64 (*64a.exe) variant
update: Permission Check Via Accesschk.EXE - add ARM64 (*64a.exe) variant
update: Procdump Execution - add ARM64 (*64a.exe) variant
update: Suspicious Use of PsLogList - add ARM64 (*64a.exe) variant
update: Sysinternals PsService Execution - add ARM64 (*64a.exe) variant
update: Sysinternals PsSuspend Execution - add ARM64 (*64a.exe) variant
update: Sysinternals PsSuspend Suspicious Execution - add ARM64 (*64a.exe) variant
update: Sysmon Configuration Update - add ARM64 (*64a.exe) variant
update: Uninstall Sysinternals Sysmon - add ARM64 (*64a.exe) variant
update: Suspicious Execution Of Renamed Sysinternals Tools - Registry - add ARM64 (*64a.exe) variant
update: Usage of Renamed Sysinternals Tools - RegistrySet - add ARM64 (*64a.exe) variant
update: Suspicious Service Installed - add ARM64 (*64a.exe) variant

Example Log Event

Fixed Issues

SigmaHQ Rule Creation Conventions

• If your PR adds new rules, please consider following and applying these conventions

[github-actions]

Welcome @einlamye 👋

It looks like this is your first pull request on the Sigma rules repository!

Please make sure to read the SigmaHQ conventions to make sure your contribution is adhering to best practices and has all the necessary elements in place for a successful approval.

Thanks again, and welcome to the Sigma community! 😃

If you want to engage more with the community for official support, general discussions or announcements:

👉 Join our Discord server

[nasbench]

LGTM