add em dash, en dash and horizontal bar to windash modifier

SigmaHQ · Jun 27, 2024 · dd51f1d · dd51f1d
1 parent 3d56b71
commit dd51f1d
Show file tree

Hide file tree

Showing 3 changed files with 27 additions and 2 deletions.
diff --git a/sigma/modifiers.py b/sigma/modifiers.py
@@ -235,10 +235,14 @@ class SigmaWindowsDashModifier(SigmaValueModifier):
     into /param-name while the second dash is left untouched.
     """
 
+    en_dash = chr(int("2013", 16))
+    em_dash = chr(int("2014", 16))
+    horizontal_bar = chr(int("2015", 16))
+
     def modify(self, val: SigmaString) -> SigmaExpansion:
         def callback(p: Placeholder):
             if p.name == "_windash":
-                yield from ("-", "/")
+                yield from ("-", "/", self.en_dash, self.em_dash, self.horizontal_bar)
             else:
                 yield p
 

diff --git a/tests/test_conversion_base.py b/tests/test_conversion_base.py
@@ -585,7 +585,7 @@ def test_convert_value_expansion_with_all(test_backend):
             )
         )
         == [
-            '(CommandLine contains "-foo" or CommandLine contains "/foo") and (CommandLine contains "-bar" or CommandLine contains "/bar")'
+            '(CommandLine contains "-foo" or CommandLine contains "/foo" or CommandLine contains "–foo" or CommandLine contains "—foo" or CommandLine contains "―foo") and (CommandLine contains "-bar" or CommandLine contains "/bar" or CommandLine contains "–bar" or CommandLine contains "—bar" or CommandLine contains "―bar")'
         ]
     )
 

diff --git a/tests/test_modifiers.py b/tests/test_modifiers.py
@@ -215,8 +215,29 @@ def test_windash(dummy_detection_item):
         [
             SigmaString("-param-1 -param2"),
             SigmaString("-param-1 /param2"),
+            SigmaString("-param-1 –param2"),
+            SigmaString("-param-1 —param2"),
+            SigmaString("-param-1 ―param2"),
             SigmaString("/param-1 -param2"),
             SigmaString("/param-1 /param2"),
+            SigmaString("/param-1 –param2"),
+            SigmaString("/param-1 —param2"),
+            SigmaString("/param-1 ―param2"),
+            SigmaString("–param-1 -param2"),
+            SigmaString("–param-1 /param2"),
+            SigmaString("–param-1 –param2"),
+            SigmaString("–param-1 —param2"),
+            SigmaString("–param-1 ―param2"),
+            SigmaString("—param-1 -param2"),
+            SigmaString("—param-1 /param2"),
+            SigmaString("—param-1 –param2"),
+            SigmaString("—param-1 —param2"),
+            SigmaString("—param-1 ―param2"),
+            SigmaString("―param-1 -param2"),
+            SigmaString("―param-1 /param2"),
+            SigmaString("―param-1 –param2"),
+            SigmaString("―param-1 —param2"),
+            SigmaString("―param-1 ―param2"),
         ]
     )