Roota: crowdstrike -> sigma: "null" or "None" for windash query

[kostiantyntest]

when crowdstrike is being translated into sigma, there is a null in selection (instead of CommandLine) which should not be as a part of detection

detection:
    language: crowdstrike-spl-query
    body: (CommandLine="-all123" OR CommandLine="/all123")