Fix to get user ID in rule 89603

wazuh · Apr 12, 2023 · 129838d · 129838d
1 parent 8cdc829
commit 129838d
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/ruleset/rules/0960-macos_rules.xml b/ruleset/rules/0960-macos_rules.xml
@@ -32,8 +32,8 @@
 
   <rule id="89603" level="3">
     <decoded_as>macOS_loginwindow</decoded_as>
-    <match>screenIsLocked</match>
-    <description>Screen locked.</description>
+    <regex type="pcre2">sendBSDNotification: \w+.\w+.\w+.screenIsLocked</regex>
+    <description>Screen locked with userID:$(userID)</description>
     <mitre>
       <id>T1078</id>
     </mitre>