Add exception for 'go run'

detection/c2/unexpected-https-client-linux.sql

@@ -136,5 +136,9 @@ WHERE
     AND s.remote_address LIKE '151.101.%'
     AND s.state = 'ESTABLISHED'
   )
+  AND NOT (
+    exception_key = '500,/tmp/main,500u,500g,main'
+    AND p.path LIKE '/tmp/go-build%/exe/main'
+  )
 GROUP BY
   p.cmdline

detection/evasion/touched-executable-linux.sql

@@ -34,5 +34,6 @@ WHERE
   AND f.path NOT LIKE '/snap/%'
   AND f.path NOT LIKE '/home/%'
   AND f.path != '/usr/local/bin/chainctl'
+  AND f.path NOT LIKE '/tmp/go-build%/exe/main'
 GROUP by
   p.pid