[Bug] Microsoft IIS Service Account Password Dumped doesn't match the command arg

[fdartayre]

Describe the bug

The query of the Microsoft IIS Service Account Password Dumped rule is:

process where host.os.type == "windows" and event.type == "start" and
   (process.name : "appcmd.exe" or ?process.pe.original_file_name == "appcmd.exe") and
   process.args : "/list" and process.args : "/text*password"

process.args : "/list" doesn't match the list command argument as described in Microsoft documentation.

To Reproduce

1. The rule doesn't detect appcmd list apppool /text:processmodel.password
2. Replacing process.args : "/list" with process.args : "list" in the rule fixes it