chore: update evtx baseline to v0.8.2

[phantinuss]

Summary of the Pull Request

Changelog

chore: update evtx baseline to v0.8.2 and fix FPs

Example Log Event

Fixed Issues

SigmaHQ Rule Creation Conventions

• If your PR adds new rules, please consider following and applying these conventions

[Copilot]

Pull Request Overview

This PR updates the EVTX baseline to version 0.8.2, which includes numerous filter refinements across Sigma detection rules to reduce false positives while maintaining detection coverage.

• Updates EVTX baseline version reference in workflows
• Adds comprehensive filters for legitimate software including antivirus products (Avira, AVG, Avast), Microsoft applications, and common development tools
• Refines existing filters with more specific path matching and additional legitimate process exclusions

Reviewed Changes

Copilot reviewed 65 out of 65 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
.github/workflows/goodlog-tests.yml	Updates EVTX baseline version to v0.8.2
.github/workflows/known-FPs.csv	Adds new known false positive patterns and consolidates existing ones
rules/windows/registry/registry_set/*	Adds filters for legitimate applications and refines existing detection logic
rules/windows/process_creation/*	Enhances filters for common software installations and system processes
rules/windows/image_load/*	Improves sideloading detection with better legitimate application exclusions
rules/windows/file/file_event/*	Refines file creation monitoring with enhanced system process filters
rules/windows/builtin/*	Updates security event filters for legitimate administrative activities
rules/windows/powershell/*	Enhances PowerShell monitoring with better module loading filters
rules-threat-hunting/*	Moves NTFS short name detection rule to threat hunting category

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

[frack113]

LGTM