fix: add check for incompatible modifier

[fukusuket]

What Changed

• fix: Incomplete field modifier(expand) rule created #552

Evidence

Test Environment

• OS: macOS Sonoma version 14.0
• Hard: MacBook Air(M1, 2020) , Memory 8GB, Core 8
• Python 3.11.1
• Hayabusa 2.12.0-dev

Test1

I confirmed that there is only a difference in the following 4 yml before and after this fix.

%diff -qr converted_sigma_rules_new/ converted_sigma_rules_old
Only in converted_sigma_rules_old/builtin/placeholder: security

% ls converted_sigma_rules_old/builtin/placeholder/security
win_security_exploit_cve_2020_1472.yml		win_security_remote_registry_management_via_reg.yml
win_security_potential_pass_the_hash.yml		win_security_susp_interactive_logons.yml

The above 4 yml file is all rules that include unsupported |expand modifier as shown below.

https://github.com/SigmaHQ/sigma/tree/412edd1e1abb29a021e51d2aca7abbbe47afca25/rules-placeholder/windows/builtin/security

Test2

I confirmed that no rule parsing errors occur.

% ./hayabusa csv-timeline -d ../hayabusa-sample-evtx -r converted_sigma_rules_new -w -q -o out.csv -C
Start time: 2023/12/19 22:05

Total event log files: 583
Total file size: 137.1 MB

Loading detection rules. Please wait.

Excluded rules: 27

Deprecated rules: 187 (4.88%) (Disabled)
Experimental rules: 1401 (36.53%)
Stable rules: 108 (2.82%)
Test rules: 2326 (60.65%)
Unsupported rules: 45 (1.17%) (Disabled)

Sigma rules: 3835
Total enabled detection rules: 3835

Output profile: standard

Scanning in progress. Please wait.

[00:00:05] 583 / 583   [========================================] 100%

I would appreciate it if you could review when you have time🙏

[YamatoSecurity]

@fukusuket I confirmed it with GitHub actions. LGTM! Thank you!