Rule 22 not functioning

[gianlucaromito]

Hi it seems that the rule 22 in file "MITRE_TECHNIQUES_FROM_SYSMON_EVENT22.xml" is not working correctly...
in the rule you can read
<if_sid>61644</if_sid>
but this sid is not there in a normal wazuh install (version 4.3.10)

What should be the correct value? I cannot get it working.
Thanks for your support!

[PwndYA]

Hey,
im not the owner but i guess you don't have the 109100-win_sysmon_new_events.xml

you will find the rule there
<rule id="61644" level="1"> <if_sid>61600</if_sid> <field name="win.system.eventID">^22$</field> <description>Sysmon - Event 22: DNS Request by $(win.eventdata.image)</description> <options>no_full_log</options> <group>sysmon_event_22,</group> </rule>

root@wazuh:~# grep -i "61644" /var/ossec/etc/rules/* /var/ossec/etc/rules/109100-win_sysmon_new_events.xml: <rule id="61644" level="1"> /var/ossec/etc/rules/MITRE_TECHNIQUES_FROM_SYSMON_EVENT22.xml:<if_sid>61644</if_sid>

[gianlucaromito]

Thanks it was the correct solution!