hello i have been facing a problem using wazuh ova while trying to add a rule
the error :Error: Could not upload rule (1113) - XML syntax error
at WzRequest.returnErrorInstance (https://192.168.0.106/414303/bundles/plugin/wazuh/wazuh.plugin.js:1:504035)
at WzRequest.apiReq (https://192.168.0.106/414303/bundles/plugin/wazuh/wazuh.plugin.js:1:503177)
at async resources_handler_ResourcesHandler.updateFile (https://192.168.0.106/414303/bundles/plugin/wazuh/wazuh.chunk.2.js:1:4178254)
at async file_editor_WzFileEditor.save (https://192.168.0.106/414303/bundles/plugin/wazuh/wazuh.chunk.2.js:1:4247451)
my code:
<?xml version="1.0" encoding="UTF-8"?> <rules> <group name="powershell,"> <rule id="100201" level="5"><category>powershell</category>
<description>Detected execution of whoami via PowerShell</description>
<decoded_as>command</decoded_as>
<match>^whoami$</match>
</rule> </group> </rules>i just want to make a rule where i can just get an alert when somone enters whoami in powershell windows
Posted Feb 19, 2026, 9:58 PM UTC