From 4cdc9485bd8ef47232eeb023b3423da993d10627 Mon Sep 17 00:00:00 2001
From: taylor_socfortress <111797488+taylorwalton@users.noreply.github.com>
Date: Fri, 30 Dec 2022 11:00:25 -0600
Subject: [PATCH] Update 200200-osquery.xml

---
 Osquery/200200-osquery.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Osquery/200200-osquery.xml b/Osquery/200200-osquery.xml
index a79c210..f5bfe75 100644
--- a/Osquery/200200-osquery.xml
+++ b/Osquery/200200-osquery.xml
@@ -617,7 +617,7 @@
   <!-- https://github.com/SigmaHQ/sigma/blob/master/rules/linux/auditd/lnx_auditd_user_discovery.yml -->
   <rule id="200287" level="12">
   <if_sid>200223</if_sid>
-  <field name="columns.cmdline">users|w|who</field>
+  <field name="columns.cmdline">^users$|^w$|^who$</field>
   <description>Adversaries may use the information from System Owner/User Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.</description>
   <options>no_full_log</options>
   <mitre>