Bug Fix - Suspicious Process Executed From Container File

[patel-bhavin]

This PR fixes a field-mapping issue in the suspicious process executed from container file detection.

The detection previously extracted the file launched from inside the archive into process_name, which could overwrite or conflict with the CIM process_name field. Since process_name should represent the actual process image, such as wscript.exe, this update renames the extracted archive member field to container_file_name.

This keeps CIM process fields accurate while still capturing the suspicious file executed from the compressed container.

Updated behavior:

process_name = actual executing process
file_name = compressed container file
container_file_name = file launched from inside the container

Slack - https://splunk.slack.com/archives/C9RE1GUSZ/p1783544914063179

[nasbench]

Why include both casing? Its already accounted for since the compare is case insensitive. Please revert your last commit

[patel-bhavin]

done! had added one of them for testing something - seems like during formatting the AI tool ended up lowercase all of them :. Should be fixed now!