JSON fields get moved over (Refactor JSON output)

[YamatoSecurity]

The following strings in CommandLine fields cause fields to move over in JSON output.
For example:
CommandLine: "C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-5a100a46-6754-48bf-98b6-dfb4c811c821 -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-b38dbe39-ce8b-4a71-8054-d0accc0482d4 -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-61321756-2096-4402-9b44-c68086290bbe -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-e0d636ca-60f5-4943-b7be-84693e092f71 -LifetimeId:ef873069-e8fe-4ac0-9ef4-6ab5ebfed851 -DeviceGroupId:-HostArg:0

becomes the following:

{
  "Timestamp": "2022-06-07 14:52:30.489 +00:00",
  "Computer": "WN5IELM6OTU.swutrust.local",
  "Channel": "Sec",
  "EventID": 4688,
  "Level": "info",
  "RecordID": 58393,
  "RuleTitle": "Proc Exec",
  "Details": {
    "Cmdline": "\"C:\\Windows\\System32\\WUDFHost.exe\" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\\UMDFCommunicationPorts\\WUDF\\HostProcess-5a100a46-6754-48bf-98b6-dfb4c811c821 -SystemEventPortName:\\UMDFCommunicationPorts\\WUDF\\HostProcess-b38dbe39-ce8b-4a71-8054-d0accc0482d4 -IoCancelEventPortName:\\UMDFCommunicationPorts\\WUDF\\HostProcess-61321756-2096-4402-9b44-c68086290bbe -NonStateChangingEventPortName:\\UMDFCommunicationPorts\\WUDF\\HostProcess-e0d636ca-60f5-4943-b7be-84693e092f71 -LifetimeId:ef873069-e8fe-4ac0-9ef4-6ab5ebfed851 | -HostArg:0\"",
    "-DeviceGroupId": "C:\\Windows\\System32\\WUDFHost.exe",
    "Proc": "0x4d8",
    "PID": "WN5IELM6OTU$",
    "User": "0x3e7"
  }
}

Another example: CommandLine: powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result:1';

becomes this in JSON:

  "Details": {
    "Cmdline": "powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final | 1';",
    "result": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe",
    "Proc": "0x1c58",
    "PID": "WN5IELM6OTU$",
    "User": "0x3e7"
  }

@hitenkoku Is this difficult to fix? If this will take time, maybe we can ask @fukusuket to take a look at it?
(I can send an evtx file to test by DM.)