feat: load `windash` characters dynamically

[fukusuket]

What Changed

• Closed #1440

Evidence

Integration-Test

All commands completed successfully. https://github.com/Yamato-Security/hayabusa/actions/runs/11637857776

I would appreciate it if you could check it out when you have time🙏

[fukusuket]

Test1

When default windash_characters.txt.

windash_characters.txt

/ # forward slash (0x002F)
- # hyphen (0x002D)
– # en dash (0x2013)
— # em dash (0x2014)
― # horizontal bar (0x2015)

% ls -la rules/config
total 304
drwxr-xr-x@ 17 fukusuke  staff    544 11  2 08:53 .
drwxr-xr-x@ 15 fukusuke  staff    480 10 24 00:53 ..
-rw-r--r--@  1 fukusuke  staff   2321 10 23 16:33 channel_abbreviations.txt
-rw-r--r--@  1 fukusuke  staff  31196 10 23 16:33 channel_eid_info.txt
drwxr-xr-x@  9 fukusuke  staff    288 10 23 15:08 data_mapping
-rw-r--r--@  1 fukusuke  staff  16482 10 23 16:33 default_details.txt
-rw-r--r--@  1 fukusuke  staff  10644 10 23 16:33 eventkey_alias.txt
-rw-r--r--@  1 fukusuke  staff   2916 10 23 16:33 exclude_rules.txt
-rw-r--r--@  1 fukusuke  staff    517 10 23 16:33 generic_abbreviations.txt
-rw-r--r--@  1 fukusuke  staff   1187 10 23 16:33 geoip_field_mapping.yaml
-rw-r--r--@  1 fukusuke  staff    100 10 23 16:33 level_tuning.txt
-rw-r--r--@  1 fukusuke  staff   1054 10 23 16:33 noisy_rules.txt
-rw-r--r--@  1 fukusuke  staff    436 10 23 16:33 pivot_keywords.txt
-rw-r--r--@  1 fukusuke  staff  47249 10 23 16:33 proven_rules.txt
-rw-r--r--@  1 fukusuke  staff    530 10 23 16:33 provider_abbreviations.txt
-rw-r--r--@  1 fukusuke  staff    898 10 23 16:33 target_event_IDs.txt
-rw-r--r--@  1 fukusuke  staff    123 11  2 08:53 windash_characters.txt

% ./hayabusa csv-timeline -d ../hayabusa-sample-evtx -w -D -n -u -r rules/sigma/builtin/system/service_control_manager/win_system_susp_service_installation_script.yml
...
╭──────────────────────────────────────────────────────────────────────────╮
│ Top critical alerts:        Top high alerts:                             │
├╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┤
│ n/a                         Suspicious Service Installation Script (250) │
│ n/a                         n/a                                          │
│ n/a                         n/a                                          │
│ n/a                         n/a                                          │
│ n/a                         n/a                                          │
├╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┤
│ Top medium alerts:          Top low alerts:                              │
├╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┤
│ n/a                         n/a                                          │
│ n/a                         n/a                                          │
│ n/a                         n/a                                          │
│ n/a                         n/a                                          │
│ n/a                         n/a                                          │
├╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┤
│ Top informational alerts:                                                │
├╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┤
│ n/a                         n/a                                          │
│ n/a                         n/a                                          │
│ n/a                         n/a                                          │
│ n/a                         n/a                                          │
│ n/a                         n/a                                          │
╰───────────────────────────╌──────────────────────────────────────────────╯

[fukusuket]

Test2

When changed windash_characters.txt.

windash_characters.txt

/ # forward slash (0x002F)

% ./hayabusa csv-timeline -d ../hayabusa-sample-evtx -w -D -n -u -r rules/sigma/builtin/system/service_control_manager/win_system_susp_service_installation_script.yml
...
╭────────────────────────────────────────────────────────────────────────╮
│ Top critical alerts:        Top high alerts:                           │
├╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┤
│ n/a                         Suspicious Service Installation Script (6) │
│ n/a                         n/a                                        │
│ n/a                         n/a                                        │
│ n/a                         n/a                                        │
│ n/a                         n/a                                        │
├╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┤
│ Top medium alerts:          Top low alerts:                            │
├╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┤
│ n/a                         n/a                                        │
│ n/a                         n/a                                        │
│ n/a                         n/a                                        │
│ n/a                         n/a                                        │
│ n/a                         n/a                                        │
├╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┤
│ Top informational alerts:                                              │
├╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┤
│ n/a                         n/a                                        │
│ n/a                         n/a                                        │
│ n/a                         n/a                                        │
│ n/a                         n/a                                        │
│ n/a                         n/a                                        │
╰───────────────────────────╌────────────────────────────────────────────╯

[fukusuket]

Test3

default

 ls -la
total 58560
drwx------@ 8 fukusuke  staff       256 11  2 14:01 .
drwxr-xr-x  9 fukusuke  staff       288 11  2 13:45 ..
-rw-r--r--@ 1 fukusuke  staff      6148 10 31 07:36 .DS_Store
-rw-r--r--@ 1 fukusuke  staff   7944974 11  2 13:46 encoded_rules.yml
-rwxr-xr-x@ 1 fukusuke  staff  10976776 11  2 13:41 hayabusa
-rwxr-xr-x@ 1 fukusuke  staff  10910088 10 23 16:33 hayabusa-2.18.0-mac-aarch64
drwxr-xr-x@ 8 fukusuke  staff       256 11  2 13:51 logs
-rw-r--r--@ 1 fukusuke  staff    137948 11  2 13:50 rules_config_files.txt

% ./hayabusa csv-timeline -d ../hayabusa-sample-evtx -w -o 1.csv -C -s --include-eid 7045
...
╭──────────────────────────────────────────────────────────────────────────────────────────────────╮
│ Top critical alerts:                              Top high alerts:                               │
├╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┤
│ CobaltStrike Service Installations - System (6)   Suspicious Service Path (277)                  │
│ n/a                                               PowerShell Scripts Installed as Services (250) │
│ n/a                                               Suspicious Service Installation Script (250)   │

changed

(Suspicious Service Installation detection count decreased)

% ./hayabusa csv-timeline -d ../hayabusa-sample-evtx -w -o 2.csv -C -s --include-eid 7045
...
╭────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮
│ Top critical alerts:                              Top high alerts:                                             │
├╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┤
│ CobaltStrike Service Installations - System (6)   Suspicious Service Path (277)                                │
│ n/a                                               PowerShell Scripts Installed as Services (250)               │
│ n/a                                               Suspicous Service Name (80)                                  │
│ n/a                                               Suspicious Service Installation (7)                          │

[fukusuket]

@YamatoSecurity I forgot about the case of rules_config_files.txt, sorry! I fixed it!