Merge PR #4859 from @vburov - Update casing of Win32_ShadowCopy for multiple rules

chore: update casing of `Win32_ShadowCopy` for multiple rules

---------

Co-authored-by: nasbench <8741929+nasbench@users.noreply.github.com>

rules/windows/powershell/powershell_script/posh_ps_create_volume_shadow_copy.yml

@@ -17,7 +17,7 @@ logsource:
 detection:
     selection:
         ScriptBlockText|contains|all:
-            - win32_shadowcopy
+            - Win32_ShadowCopy
             - ').Create('
             - ClientAccessible
     condition: selection

rules/windows/powershell/powershell_script/posh_ps_susp_win32_shadowcopy.yml

@@ -18,7 +18,7 @@ detection:
     selection:
         ScriptBlockText|contains|all:
             - 'Get-WmiObject'
-            - 'Win32_Shadowcopy'
+            - 'Win32_ShadowCopy'
             - '.Delete()'
     condition: selection
 falsepositives:

rules/windows/powershell/powershell_script/posh_ps_susp_win32_shadowcopy_deletion.yml

@@ -27,7 +27,7 @@ detection:
             - 'Get-CimInstance'
             - 'gcim'
     selection_shadowcopy:
-        ScriptBlockText|contains: 'Win32_Shadowcopy'
+        ScriptBlockText|contains: 'Win32_ShadowCopy'
     selection_delete:
         ScriptBlockText|contains:
             - '.Delete()'