FIM Custom rules for Windows

[Calebasah]

[eva672]

I updated the regex patterns in the scheduled task rules because Wazuh’s rule engine does not support inline flags

Changes made:

• Rule (100101)

Changed ^\Microsoft\|^\Windows\

To ^(\Microsoft\|\Windows\)

Reason: Without parentheses, the | alternation was being applied incorrectly (^ only applied to the first branch). Parentheses ensure both paths (\Microsoft\ and \Windows) are matched properly from the start of the string.

• Rule (100104)

Changed ^\Microsoft\|^\Windows\

To ^(\Microsoft\|\Windows\)

Reason: Same alternation fix as above, so the negate works correctly.

New rule

[Calebasah]

WIP. working on the rules on a local cluster

[Calebasah]

Still implementing in dev