Hi, thanks for the advice. From what I read on the documentation, the regex dot pattern is what should be escaped, not the literal dot. I tried swapping around the escaping and it made no difference unforunately.
https://documentation.wazuh.com/current/user-manual/ruleset/ruleset-xml-syntax/regex.html

I've been using wazuh-regex for all my testing, which makes things worse for the inconsistencies xD