From 3ce71ccaaa2e21bf332f9252bd6130c416790db7 Mon Sep 17 00:00:00 2001
From: DenizenB <github@podd.xyz>
Date: Sun, 30 Jul 2023 09:12:50 +0000
Subject: [PATCH] fix cidr expansion for backends that use custom wildcard char

If a backend defines `wildcard_multi` as something other than `*`,
then it won't be parsed as a wildcard by `SigmaString` and will
therefore be escaped when the `SigmaString` is converted to a regular
string.
---
 sigma/conversion/base.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sigma/conversion/base.py b/sigma/conversion/base.py
index be8a0c08..45caafcf 100644
--- a/sigma/conversion/base.py
+++ b/sigma/conversion/base.py
@@ -1110,7 +1110,7 @@ def convert_condition_field_eq_val_cidr(
                 netmask=cidr.network.netmask,
             )
         else:  # No native CIDR support: expand into string wildcard matches on prefixes.
-            expanded = cidr.expand(self.wildcard_multi)
+            expanded = cidr.expand()
             expanded_cond = ConditionOR(
                 [
                     ConditionFieldEqualsValueExpression(cond.field, SigmaString(network))