I want to create a rule for MSExchange, the query string for the rule was taken from Sigma rules and converted to a Lucene query format with the help of sigma converter. However, when I click the "test rule" it fails on escaping a dash charecter. I tried to remove the backslashes but it didn't work as well.
The configuration for the rule looks like below:
query: "winlog.channel:MSExchange\ Management AND ((event.code:(6 OR 8)) AND (winlog.event_data.Data:(*Cmdlet\ failed.\ Cmdlet\ Get-App,\ * OR Task\ Get-App\ throwing\ unhandled\ exception:\ System.InvalidCastException:)))"
When I click test rule it shows the following error:
unknown escape sequence at line 3, column 139: ... :(*Cmdlet\ failed.\ Cmdlet\ Get\-App,\ * OR *Task\ Get\-App\ thr ... ^
The error doesn't show the full text, just the pop-up window on the bottom right of the UI