[memx13]

What

Detection identifiers may contain - (identifier_chars = alphanums + "_-") and parse fine when referenced by name. But the pattern used by 1 of x-* / all of x-* only accepted alphanums + "*_", so referencing a dashed identifier through a wildcard pattern raised SigmaConditionError.

Reproduction

detection:
    sel-img:
        Image|endswith: '\powershell.exe'
    sel-cli:
        CommandLine|contains: ' -enc '
    condition: 1 of sel-*

1 of sel-* raises SigmaConditionError: Expected end of text, found '-', while the equivalent sel-img or sel-cli parses fine. The project already expects dashed identifiers elsewhere (test fixtures use keyword-list, field-value; filters.py builds a pattern containing -), and the Sigma spec does not restrict identifier characters.

Change

identifier_pattern now reuses identifier_chars (plus *), so the wildcard pattern accepts exactly the characters identifiers already allow. _ was added to this same pattern in 2021 (c86073b) for the same reason; this adds - alongside it.

Tests

Added test_selector_pattern_with_dash, covering 1 of / any of / all of over a dashed wildcard pattern. The three cases fail before the change (SigmaConditionError) and pass after it. Full tests/test_conditions.py is green and black --check is clean on both files.