Implement `utf16/utf16be/utf16le/wide` modifiers

[YamatoSecurity]

Although not used in any rules yet, we would like to support the following modifiers for sigma support completeness:

• utf16|base64offset|contains
• utf16be|base64offset|contains
• utf16le|base64offset|contains
• wide|base64offset|contains

Probably no need to support as base64offset is usually used instead of base64:

• utf16|base64|contains
• utf16be|base64|contains
• utf16le|base64|contains
• wide|base64|contains

Example:

detection:
  selection:
    CommandLine|wide|base64offset|contains: "ping"

Info: https://sigmahq.io/docs/basics/modifiers.html#wide

Prepends a byte order mark and encodes UTF16, (only used in combination with base64 modifiers)

Don't end with utf16, utf16le, utf16be or wide

The value modifier chain must not end with character set encoding modifiers (utf16, utf16le, utf16be and wide). The resulting values are internally represented as byte sequences instead of text strings and contain null characters which are usually difficult to handle in queries. Therefore the should be followed by an encoding modifier (base64, base64offset)

I think we should implement utf16 to check both utf16be and utf16le variants. wide should be an alias for utf16le in Windows.

We should probably investigate if these encodings are being used inside base64 encoded payloads to begin with. If not, then it probably is not worth implementing.

[hitenkoku]

The value modifier chain must not end with character set encoding modifiers (utf16, utf16le, utf16be and wide). The resulting values are internally represented as byte sequences instead of text strings and contain null characters which are usually difficult to handle in queries. Therefore the should be followed by an encoding modifier (base64, base64offset) Usually it doesn't makes sense to combine the re type modifier with any other modifier.

https://github.com/SigmaHQ/sigma/wiki/Rule-Creation-Guide

[YamatoSecurity]

@hitenkoku Thanks for the information! I was mistaken on how it was being used. I updated the specifications.