Configured ReplaceStringTransformation appropriately

Reconfigured the `ReplaceStringTransformation`s to ignore special characters and to interpret special characters in replacements as required to fix issue #17
SigmaHQ · Oct 13, 2024 · 86f7bfc · 86f7bfc
1 parent 9a4b97e
commit 86f7bfc
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/sigma/pipelines/crowdstrike/crowdstrike.py b/sigma/pipelines/crowdstrike/crowdstrike.py
@@ -440,7 +440,7 @@ def common_processing_items():
         ProcessingItem(
             identifier="cql_imagefilename_replace_disk_name",
             transformation=ReplaceStringTransformation(
-                regex="[C-Z]:", replacement="\\\\Device\\\\HarddiskVolume?"
+                regex="[C-Z]:", replacement="\\\\Device\\\\HarddiskVolume?", skip_special=True, interpret_special=True
             ),
             field_name_conditions=[
                 IncludeFieldCondition(fields=["ImageFileName"]),
@@ -450,7 +450,7 @@ def common_processing_items():
         ),
         ProcessingItem(
             identifier="cql_imagefilename_replace_disk_name",
-            transformation=ReplaceStringTransformation(regex=":", replacement=""),
+            transformation=ReplaceStringTransformation(regex=":", replacement="", skip_special=True),
             field_name_conditions=[
                 IncludeFieldCondition(fields=["ImageFileName"]),
                 IncludeFieldCondition(fields=["TargetImageFileName"]),