Fix pySigma RE2 compatibility in fresh installations

tests/test_sigma_rules.py

@@ -13,6 +13,22 @@ def rule(detection: str, service: str = "") -> str:
 
 
 class SigmaTests(unittest.TestCase):
+    def test_lookahead_rule_on_raw_and_decoded_text(self) -> None:
+        matcher = SigmaMatcher.from_yaml(
+            rule(
+                "  s:\n"
+                "    raw|re: '(?im)^(?=.*(?:pitboss|NSPPE))"
+                "(?=.*(?:base64|PD9))(?=.*(?:2N|httpaccess))'\n"
+                "  condition: s\n"
+            )
+        )
+        sample = "pitboss NSPPE base64 httpaccess"
+        self.assertTrue(matcher.search({"raw": sample}))
+        hits = matcher.search_with_details({"raw": "encoded record"}, [sample])
+        self.assertEqual(hits[0]["basis"], ["decoded:0"])
+        for benign in ("pitboss NSPPE", "base64 httpaccess", "NSPPE base64"):
+            self.assertFalse(matcher.search({"raw": benign}))
+
     def test_catalog_not_repeated_in_hit(self) -> None:
         text = rule("  s: [abc]\n  condition: s\n")
         text += "indicators:\n  - type: ipv4\n    value: 192.0.2.1\n    status: reference_only\n"