Trailing backslashes escape wildcards added by modifiers #431
Description
From the community Discord:
When converting a Sigma rule to the EQL using the elastic backend and the ecs_windows pipeline, strings ending with a backslash immediately followed by a wildcard (due to the contains modifier) are not correctly escaped in the final query.
Example of incorrect output for a rule matching on the path \Desktop\:
The backend would generate:
... like~ ("*\\Desktop\*")
(Note: The \ before the final * is not escaped)
Expected correct output for the same rule:
The query should have a double backslash before the final wildcard to represent a literal escaped backslash:
... like~ ("*\\Desktop\\*")
(Note: The \ before the final * is now escaped as \\)