Preserve relative path indicator matches for iOS artifacts

src/mvt/ios/paths.py

@@ -43,4 +43,5 @@ def check_ios_path(indicators: Indicators, path: str) -> Optional[IndicatorMatch
         match = indicators.check_file_path(candidate)
         if match:
             return match
-    return None
+    # Filesystem records and existing indicators may both use relative paths.
+    return indicators.check_file_path(posixpath.normpath(path.replace("\\", "/")))

tests/test_ios_coruna.py

@@ -187,6 +187,10 @@ def test_path_only_alert_is_medium():
         ("/var/tmp/ioslab_ctl", "private\\var\\tmp\\ioslab_ctl", True),
         ("/var/tmp/ioslab_ctl", "/var/tmp/ioslab_ctl2", False),
         ("/private/var/tmp/.ghost_upper/", "/var/tmp/.ghost_upper-copy/file", False),
+        ("matched/directory", "matched/directory/file", True),
+        ("matched/directory", "matched\\directory\\file", True),
+        ("matched/directory", "matched/directory-copy/file", False),
+        ("matched/directory", "matched/directory/../other/file", False),
     ],
 )
 def test_ios_path_iocs_respect_aliases_and_boundaries(ioc, path, expected):