Does RemoveFieldTransformation work as expected?

[HenrikWittemeier]

I tried to use RemoveFieldTransformation to remove a field from a sigma rule: Rule:

[...]
detection:
    selection:
        record_type: 'TXT'
        answer|contains:
            - 'IEX'
            - 'Invoke-Expression'
            - 'cmd.exe'
    condition: selection

Code

ProcessingItem(
                identifier="dns_answer_txt_remove_field",
                transformation=RemoveFieldTransformation("record_type"),
                rule_conditions=[
                    RuleContainsDetectionItemCondition("record_type","TXT")
                ],
            ),

Expected result:

[...]
detection:
    selection:
        answer|contains:
            - 'IEX'
            - 'Invoke-Expression'
            - 'cmd.exe'
    condition: selection

But instead the field was not removed.

While debugging i found, that:

https://github.com/SigmaHQ/pySigma/blob/ba2515542a3e35e00d4bf8979f228e64a5f7dc9b/sigma/processing/transformations.py#L735

rule.fields is just an empty list.