Custom PowerShell rules

To enhance the Wazuh detection capabilities for Windows machines, we need to integrate some custom PowerShell Wazuh rules. Each rule can be created with specific conditions, severity levels, and other optional configurations. We will cover the following types of rules in this section:

• PowerShell event information
• PowerShell error logs
• PowerShell warning logs
• PowerShell critical logs

PowerShell event information

We can create a custom PowerShell rule to get event information, as shown in the following:

<rule id="200101" level="1">
    <if_sid>60009</if_sid>
    <field name="win.system.providerName">^PowerShell$</field>
    <options>no_full_log</options>
    <group>windows_powershell,</group>
    <description>PowerShell Log Information</description...