fix(tests): recognize sysmon, wevtutil, auditpol as detection commands

Blue's detect_procedure extraction had zero Blue-team-oriented tool
names in its known-binaries list — sysmon.exe, one of the most common
Windows detection tools, silently produced no suggestion at all.
Verified against the exact production input that surfaced this.

backend/tests/test_procedure_extraction_service.py

@@ -95,3 +95,15 @@ def test_known_binary_at_start_of_line_is_recognized():
     text = "Notes: used the following.\nsudo tcpdump -i eth0 -w capture.pcap\nCaptured 500 packets."
     result = extract_commands(text)
     assert result == "sudo tcpdump -i eth0 -w capture.pcap"
+
+
+def test_recognizes_sysmon_as_a_detection_command():
+    text = "launch sysmon to detect\nsysmon.exe\nthen search this query\n\\? mimikatz \\n"
+    result = extract_commands(text)
+    assert result == "sysmon.exe"
+
+
+def test_recognizes_wevtutil_and_auditpol():
+    text = "Pulled the security log.\nwevtutil qe Security /c:5\nThen checked audit policy.\nauditpol /get /category:*"
+    result = extract_commands(text)
+    assert result == "wevtutil qe Security /c:5\nauditpol /get /category:*"