Support `windash` pipe modifier about hayabusa HOT 5 CLOSED

@fukusuket Until we can support this in Hayabusa directly, do you think we can support this by updating the converter by adding the variant where - characters are replaced with /?

It seems possible, so I'll check it out!💪

from hayabusa.

@YamatoSecurity Sorry for late reply.
I will check it.

from hayabusa.

@hitenkoku Could I ask you to look into how to support the |contains|windash modifier in Hayabusa?

from hayabusa.

@hitenkoku Thanks so much! No hurry so whenever you have free time is completely fine!

from hayabusa.

Note: There are also rules that use a |contains|all|windash modifier. We can create a different issue for this.

Example:
https://github.com/SigmaHQ/sigma/blob/8894f912b801682fd8feabff44459f6df5fa3e6b/rules/windows/process_creation/proc_creation_win_rpcping_credential_capture.yml#L2

from hayabusa.