Repository: SigmaHQ/pySigma-backend-crowdstrike (language: python)

Issue:
Curly brackets are not being escaped
Hi guys,

Curly brackets are not being escaped and a couple of sigma rules are causing syntax errors.

Source:
https://github.com/SigmaHQ/pySigma-backend-crowdstrike/blob/1fdd29d5cac228687398769a09a8a4f68680b0b4/sigma/backends/crowdstrike/logscale.py#L127

Suggested fix:
```
add_escaped_re: ClassVar[str] = "*$^.|?()[]{}+/"
```

Affected sigma rules:
* https://github.com/SigmaHQ/sigma/blob/598d29f811c1859ba18e05b8c419cc94410c9a55/rules/windows/process_creation/proc_creation_win_hktl_relay_attacks_tools.yml#L47
* https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_powershell_iex_patterns.yml#L25


Discussion / hints:

Fix patch:
diff --git a/sigma/backends/crowdstrike/logscale.py b/sigma/backends/crowdstrike/logscale.py
index 53a7b17..129aeeb 100644
--- a/sigma/backends/crowdstrike/logscale.py
+++ b/sigma/backends/crowdstrike/logscale.py
@@ -124,7 +124,7 @@ class LogScaleBackend(TextQueryBackend):
     escape_char_re: ClassVar[str] = "\\"
     wildcard_multi_re: ClassVar[str] = ".*"
     wildcard_single_re: ClassVar[str] = "."
-    add_escaped_re: ClassVar[str] = "*$^.|?()[]+/"
+    add_escaped_re: ClassVar[str] = "*$^.|?()[]+/{}"
     filter_chars_re: ClassVar[str] = ""
     bool_values_re: ClassVar[Dict[bool, str]] = {
         True: "true",


Test patch:
diff --git a/tests/test_backend_logscale.py b/tests/test_backend_logscale.py
index 40eae25..044b09c 100644
--- a/tests/test_backend_logscale.py
+++ b/tests/test_backend_logscale.py
@@ -43,12 +43,12 @@ def test_crowdstrikelogscale_special_chars(logscale_backend: LogScaleBackend):
                 product: test_product
             detection:
                 sel:
-                    fieldA: valueA*$^.|?()[]+/
+                    fieldA: valueA*$^.|?()[]+/{}
                 condition: sel
         """
             )
         )
-        == ["fieldA=/^valueA.*\\$\\^\\.\\|.\\(\\)\\[\\]\\+\\/$/i"]
+        == ["fieldA=/^valueA.*\\$\\^\\.\\|.\\(\\)\\[\\]\\+\\/\\{\\}$/i"]
     )