Add em dash, en dash and horizontal bar to windash modifier

[martinspielmann]

The existing windash modifier takes into account that many Windows programs accept their arguments provided via / and -.

However, multiple programs including Powershell additionally support – (en dash), — (em dash), and ― (horizontal bar). E.g. see the Powershell Tokenizer that handles all dashes the same way:

Downside:

• More search parameters and complexity: Every windash expanded argument string will result in five (5) search parameters instead of only two (2). This multiplies when there is more than one arguments processed by windash. See tests/test_modifiers.py

Advantage:

• Detection of simple command-line obfuscation relying on hiding command-line arguments.

References

• https://www.youtube.com/watch?v=52tAmVLg1KM&t=565s by @wietze

[thomaspatzke]

Great, thanks for the PR!