From 36303c9f58cfbebff7aa6919468db59b5a0108dc Mon Sep 17 00:00:00 2001
From: taylor_socfortress <111797488+taylorwalton@users.noreply.github.com>
Date: Tue, 7 Feb 2023 10:59:42 -0600
Subject: [PATCH] Update 200200-osquery.xml

---
 Osquery/200200-osquery.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Osquery/200200-osquery.xml b/Osquery/200200-osquery.xml
index d430d41..f315472 100644
--- a/Osquery/200200-osquery.xml
+++ b/Osquery/200200-osquery.xml
@@ -417,7 +417,7 @@
   <group>bpf_process_events,</group>
   </rule>
   
-  <rule id="200272" level="12">
+  <rule id="200272" level="10">
   <if_sid>200223</if_sid>
   <field name="columns.cmdline">chage|passwd</field>
   <field name="columns.cmdline">--list|-l|-S|--status</field>