From f710664dc0c6b3e2297151fb2f8f74706e360771 Mon Sep 17 00:00:00 2001
From: fukusuket <41001169+fukusuket@users.noreply.github.com>
Date: Tue, 21 Feb 2023 21:53:05 +0900
Subject: [PATCH] fix: sigmac conversion error with base64offset|contains rule

---
 tools/sigma/parser/modifiers/transform.py | 1 +
 1 file changed, 1 insertion(+)

diff --git a/tools/sigma/parser/modifiers/transform.py b/tools/sigma/parser/modifiers/transform.py
index 8a5267999..de47b3f32 100644
--- a/tools/sigma/parser/modifiers/transform.py
+++ b/tools/sigma/parser/modifiers/transform.py
@@ -24,6 +24,7 @@ class SigmaContainsModifier(ListOrStringModifierMixin, SigmaTransformModifier):
     """Add *-wildcard before and after all string(s)"""
     identifier = "contains"
     active = True
+    valid_input_types = ListOrStringModifierMixin.valid_input_types + (NodeSubexpression,)
 
     def apply_str(self, val):
         try: