There's no logical OR in hashcat rules, because the complexity of expressing when you want to do one or the other is either so simple that it's easier to just do both, or else complicated enough to need to be scripted outside of hashcat.
Most attacks simple do both - either in a single rules file, or by stacking multiple rules files with -r
. For most GPU-based attacks, there's no reason to not simply do both, in order to supply enough work to the GPU(s) to fully utilize them.
For example, if you want to always capitalize the word, and then perform one or the other substitution, a single rules file would contain:
c sa>
c sa0
Or you could stack two rules files:
file1.rules:
c
file2.rules:
sa>
sa0
... and then invoked with -r file1.rules -r file2.rules
.
These are just two different methods to produce the identical final ruleset as executed by hashcat.