Repository: SigmaHQ/pySigma-backend-crowdstrike (language: python)

Issue:
Unix paths are not properly escaped
Hi guys,

We noticed that the unix path is not properly escaped in the regular expresions

## sample rule
```
  noise:
    Image|re:
      - '^\/usr\/bin\/perl'
    Image|endswith:
      - '/perl'
    Image|startswith:
      - '/usr/bin/perl'
    Image|contains:
      - '/perl'
  condition: not noise
```

## endswith

Current output
```
 ImageFileName=//perl$/i 
```
Should be
```
 ImageFileName=/\/perl$/i
```

## startswith
Current output
```
ImageFileName=/^/usr/bin/perl/i
```
Should be
```
ImageFileName=/^\/usr\/bin\/perl/i
```


Discussion / hints:

Fix patch:
diff --git a/sigma/backends/crowdstrike/logscale.py b/sigma/backends/crowdstrike/logscale.py
index 10fc54e..a6b71b6 100644
--- a/sigma/backends/crowdstrike/logscale.py
+++ b/sigma/backends/crowdstrike/logscale.py
@@ -124,7 +124,7 @@ class LogScaleBackend(TextQueryBackend):
     escape_char_re: ClassVar[str] = "\\"
     wildcard_multi_re: ClassVar[str] = ".*"
     wildcard_single_re: ClassVar[str] = "."
-    add_escaped_re: ClassVar[str] = "*$^.|?()[]+"
+    add_escaped_re: ClassVar[str] = "*$^.|?()[]+/"
     filter_chars_re: ClassVar[str] = ""
     bool_values_re: ClassVar[Dict[bool, str]] = {
         True: "true",


Test patch:
diff --git a/tests/test_backend_logscale.py b/tests/test_backend_logscale.py
index f339826..0989ef3 100644
--- a/tests/test_backend_logscale.py
+++ b/tests/test_backend_logscale.py
@@ -43,12 +43,12 @@ def test_crowdstrikelogscale_special_chars(logscale_backend: LogScaleBackend):
                 product: test_product
             detection:
                 sel:
-                    fieldA: valueA*$^.|?()[]+
+                    fieldA: valueA*$^.|?()[]+/
                 condition: sel
         """
             )
         )
-        == ["fieldA=/^valueA.*\\$\\^\\.\\|.\\(\\)\\[\\]\\+$/i"]
+        == ["fieldA=/^valueA.*\\$\\^\\.\\|.\\(\\)\\[\\]\\+\/$/i"]
     )