chore(rules): Reorder not operators

Make sure the not operator is placed after the field.

Author: rabbitstack

rules/defense_evasion_dll_sideloading_via_copied_binary.yml

@@ -20,7 +20,7 @@ labels:
 condition: >
   sequence
   maxspan 8m
-    |create_file and file.is_exec and not ps.sid in ('S-1-5-18', 'S-1-5-19', 'S-1-5-20')
+    |create_file and file.is_exec and ps.sid not in ('S-1-5-18', 'S-1-5-19', 'S-1-5-20')
       and
      thread.callstack.symbols imatches ('*CopyFile*', '*MoveFile*')
     | by file.name

rules/defense_evasion_potential_process_hollowing_injection.yml

@@ -29,7 +29,7 @@ references:
 condition: >
   sequence
   maxspan 2m
-    |spawn_process and not ps.sid in ('S-1-5-18', 'S-1-5-19', 'S-1-5-20') and not ps.exe imatches 
+    |spawn_process and ps.sid not in ('S-1-5-18', 'S-1-5-19', 'S-1-5-20') and not ps.exe imatches 
       (
         '?:\\Program Files\\*', 
         '?:\\Program Files (x86)\\*'