[Backport 2.x] Add an "exists" check for "not" condition in sigma rules

[Backport 2.x] Add an "exists" check for "not" condition in sigma rules #1803