Reduce more false positives found on macOS and Linux

detection/c2/unexpected-https-client-linux.sql

@@ -80,7 +80,6 @@ WHERE
     '500,/app/zoom.real,u,g,zoom.real',
     '500,/home/chainctl,500u,100g,chainctl',
     '500,/home/chainctl,500u,500g,chainctl',
-    '500,/usr/gnome-recipes,0u,0g,gnome-recipes',
     '500,/home/gitsign,500u,500g,gitsign',
     '500,/home/go,500u,500g,go',
     '500,/home/jcef_helper,500u,500g,jcef_helper',
@@ -105,7 +104,9 @@ WHERE
     '500,/usr/flatpak-oci-authenticator,0u,0g,flatpak-oci-aut',
     '500,/usr/geoclue,0u,0g,geoclue',
     '500,/usr/gitsign,0u,0g,gitsign',
+    '500,/usr/gnome-recipes,0u,0g,gnome-recipes',
     '500,/usr/gnome-software,0u,0g,gnome-software',
+    '500,/usr/go,0u,0g,go',
     '500,/usr/go,500u,500g,go',
     '500,/usr/gvfsd-http,0u,0g,gvfsd-http',
     '500,/usr/java,0u,0g,java',

detection/c2/unexpected-talkers-macos.sql

@@ -126,6 +126,7 @@ WHERE
     '22,6,500,Cyberduck,ch.sudo.cyberduck,Developer ID Application: David Kocher (G69SCX94XU)',
     '22,6,500,ssh,,',
     '22,6,500,ssh,com.apple.openssh,Software Signing',
+    '22,6,500,ssh,com.apple.ssh,Software Signing',
     '22,6,500,ssh,ssh,',
     '22,6,500,ssh,ssh-55554944fbf65684ab9b37c2bad3a27ef78b23f4,',
     '30004,6,500,java,net.java.openjdk.java,Developer ID Application: Microsoft Corporation (UBF8T346G9)',

detection/execution/exotic-command-events-macos.sql

@@ -115,3 +115,4 @@ WHERE
     AND p.parent = -1
   )
   AND NOT cmd LIKE '/bin/rm -f /tmp/periodic.%'
+  AND NOT cmd LIKE 'touch -r /tmp/KSInstallAction.%'

detection/execution/unexpected-osascript-calls.sql

@@ -43,6 +43,7 @@ WHERE
     ',,osascript -e set zoomStatus to "closed"\x0Aset muteStatu'
   )
   AND cmd != 'osascript -e user locale of (get system info)'
+  AND cmd NOT LIKE 'osascript -e set zoomStatus to "closed"%'
   AND NOT (
     exception_key = 'org.python.python,,osascript'
     AND parent_cmd LIKE '% /opt/homebrew/bin/jupyter-notebook'