Regex Escaping for EQL

[WildDogOne]

According to the Elastic documentation since backslash () is also the escaping character for json it needs to be escaped itself.
For example if a Sigma rule is "username|re: '$'" is would have to translate to regex~ "\$"
Or at least that is my understanding of how it should work.

Imho this could mean it would be possible to just do a character replace around here:

pySigma-backend-elasticsearch/sigma/backends/elasticsearch/elasticsearch_eql.py

Line 98 in bb0c64c

re_expression: ClassVar[str] = '{field} regex~ "{regex}"'

re_expression: ClassVar[str] = '{field} regex~ "{regex.replace("\","\\")}"'