incorrect conversion of regular expressions

[conitrade-as]

Trying to convert sigma rules to an elasticsearch backend with the sysmon pipeline does not convert regular expressions. Consider the following example:

title: Test Rule with Regular Expression
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\svchost.exe'
    filter_main_flags:
        CommandLine|re: '-k\s\w{1,64}(\s?(-p|-s))?'
    condition: selection and not 1 of filter_main_*

The following command line is used for conversion:

sigma convert -t lucene -p sysmon -p ecs_windows rule.yaml

Converting the rule currently yields the following:

winlog.channel:Microsoft\-Windows\-Sysmon\/Operational AND (event.code:1 AND (process.executable:*\\svchost.exe AND (NOT process.command_line:SigmaRegularExpression\(regexp\=SigmaString\(\['\-k\\s\\w\{1,64\}\(\\s',\ \<SpecialChars.WILDCARD_SINGLE\:\ 2\>,\ '\(\-p\|\-s\)\)',\ \<SpecialChars.WILDCARD_SINGLE\:\ 2\>\]\),\ flags\=set\(\)\))))

Reverting changes from 8914d68 however yields the following:

winlog.channel:Microsoft\-Windows\-Sysmon\/Operational AND (event.code:1 AND (process.executable:*\\svchost.exe AND (NOT process.command_line:/-k\s\w{1,64}(\s?(-p|-s))?/)))

[conitrade-as]

This seems to be in the same vain as #174. How does one add a condition to exclude regular expressions?

[sudo-d4s3]

There are 2 ways to fix this that I can think of.
We could create a conditional for regular expressions, similar to #174 or we can set __str__() to use self.to_plain() in the SigmaRegularExpression class.

I don't know which method would be better. I'm currently using a patch to set the latter and haven't noticed any issues but I haven't tested extensively.

[RobertN87]

Also reproduces on the latest release, and the scope is broader than the
original example: it affects the EQL target too (not just Lucene), and every
|re regex is affected regardless of its content.

Environment: pySigma-backend-elasticsearch 2.0.2 and 2.0.3, pySigma
1.3.3, sigma-cli 3.0.2, Python 3.14. (The 1.x line — backend 1.1.6 / pySigma
0.11.23 — renders regex correctly.)

Minimal rule:

title: min re
logsource:
    category: process_creation
    product: windows
detection:
    sel:
        CommandLine|re: 'foobar[0-9]{3}'
    condition: sel

EQL — sigma convert -t eql -p ecs_windows min_re.yml
Actual:

any where process.command_line:"SigmaRegularExpression(regexp=SigmaString(['foobar[0-9]{3}']), flags=set())"

Expected:

any where process.command_line regex~ "foobar[0-9]{3}"

Lucene — sigma convert -t lucene -p ecs_windows min_re.yml
Actual:

process.command_line:SigmaRegularExpression\(regexp\=SigmaString\(\['foobar[0-9]\{3\}'\]\),\ flags\=set\(\)\)

Expected:

process.command_line:/foobar[0-9]{3}/

The SigmaRegularExpression(...) text is the AST object's repr ending up in the
value position, so the converted query matches that literal string and a rule
using |re never matches.