Update windows.py (#120)

Mapping for PowerShell Payload data according to https://www.elastic.co/guide/en/beats/winlogbeat/current/exported-fields-powershell.html

sigma/pipelines/elasticsearch/windows.py

@@ -155,6 +155,7 @@ def ecs_windows() -> ProcessingPipeline:
                         "TargetDomainName": "user.domain",
                         "User": "user.name",
                         "WorkstationName": "source.domain",
+                        "Payload": "powershell.file.script_block_text",
                     }
                 ),
                 rule_conditions=[LogsourceCondition(product="windows")],