paulmataruso/main
1
0
Fork 0
mirror of https://github.com/socfortress/Wazuh-Rules.git synced 2025-10-30 03:13:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update 200200-osquery.xml

Browse Source
This commit is contained in:
taylor_socfortress
2023-02-07 10:59:42 -06:00
committed by GitHub
parent 69582a0eb8
commit 36303c9f58
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
Osquery/200200-osquery.xml
View File

@@ -417,7 +417,7 @@
<group>bpf_process_events,</group> <group>bpf_process_events,</group>
</rule> </rule>
<rule id="200272" level="12"> <rule id="200272" level="10">
<if_sid>200223</if_sid> <if_sid>200223</if_sid>
<field name="columns.cmdline">chage|passwd</field> <field name="columns.cmdline">chage|passwd</field>
<field name="columns.cmdline">--list|-l|-S|--status</field> <field name="columns.cmdline">--list|-l|-S|--status</field>