diff --git a/detection/execution/recently-created-executables.sql b/detection/execution/recently-created-executables.sql index fd24e9e..b7c67a2 100644 --- a/detection/execution/recently-created-executables.sql +++ b/detection/execution/recently-created-executables.sql @@ -127,7 +127,7 @@ WHERE AND NOT p.path LIKE '/private/var/db/com.apple.xpc.roleaccountd.staging/%' AND NOT p.path LIKE '/private/var/folders/%/bin/%' AND NOT p.path LIKE '/private/var/folders/%/go-build%' - AND NOT p.path LIKE '/private/var/folders/%/T/download/ARMDCHammer + AND NOT p.path LIKE '/private/var/folders/%/T/download/ARMDCHammer' AND NOT p.path LIKE '/private/var/folders/%/GoLand/%' AND NOT p.path LIKE '/private/var/folders/%/T/pulumi-go.%' AND NOT p.path LIKE '/Users/%/bin/%'