fix: |re matching is not done correctly, so use is_match instead of find_iter

[fukusuket]

What Changed

• Fixed [bug] |re modifier rule does not detect logs correctly #1211
  • Changed to use is_match instead of find_iter.

Evidence

Enviroment

• OS: macOS Sonoma version 14.0

Test

I run the steps to reproduce #1211 and confirmed that 6 cases were detected as follows.

% ./hayabusa csv-timeline -d ../hayabusa-sample-evtx -r test.yml -w -o out.csv -C -q
...
Results Summary:

Events with hits / Total events: 6 / 47,465 (Data reduction: 47,459 events (99.99%))

Total | Unique detections: 6 | 1
Total | Unique critical detections: 0 (0.00%) | 0 (0.00%)
Total | Unique high detections: 0 (0.00%) | 0 (0.00%)
Total | Unique medium detections: 0 (0.00%) | 0 (0.00%)
Total | Unique low detections: 0 (0.00%) | 0 (0.00%)
Total | Unique informational detections: 6 (100.00%) | 1 (100.00%)

I would appreciate it if you could review when you have time🙏

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Comparison is base (7006a2d) 83.60% compared to head (5b030e0) 83.61%.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1212      +/-   ##
==========================================
+ Coverage   83.60%   83.61%   +0.01%     
==========================================
  Files          26       26              
  Lines       23818    23835      +17     
==========================================
+ Hits        19912    19929      +17     
  Misses       3906     3906              

Files	Coverage Δ
src/detections/rule/matchers.rs	97.35% <100.00%> (+0.01%)	⬆️

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[hitenkoku]

LGTM

[fukusuket]

@hitenkoku Thank you so much for review :) Sorry... There was a regression case, so I'll draft it once...

[fukusuket]

The detection result diff of hayabusa-sample-evtx was as follows.
It seems that there is a regression in case Renamed Exe File , so I will check...

Rule title	level	main	This PR
Invoke-Obfuscation Obfuscated IEX Invocation - PowerShell	high	0	9
Invoke-Obfuscation Via Use Clip - Powershell	high	0	1
Potential AD User Enumeration From Non-Machine Account	med	5	17
Powershell Token Obfuscation - Powershell	high	0	10
Renamed Exe File	low	6	0

[fukusuket]

@hitenkoku @YamatoSecurity
The diff in theRenamed Exe File case was not caused by a regression, but by the issue below.
Yamato-Security/hayabusa-rules#526

Therefore, the difference in the number of detections above does not seem to be a problem :)

[YamatoSecurity]

@fukusuket Sorry it took some time. I took some benchmarks and this PR is slightly faster, uses about the same memory and detects more! So LGTM!