Add execdir exception for ~/%packages

2025-02-09 22:16:53 +00:00 · 2023-01-04 11:09:20 -05:00 · 2023-01-04 11:09:20 -05:00 · 5735d87453
commit 5735d87453
parent 71cda72dc1
1 changed files with 1 additions and 0 deletions
--- a/detection/execution/unexpected-execdir-events-macos.sql
+++ b/detection/execution/unexpected-execdir-events-macos.sql
@ -145,6 +145,7 @@ WHERE
    '~/.vscode/',
    '~/.vs-kubernetes/'
  )
+  AND top_dir NOT LIKE '~/%packages/'
  -- Locally built executables
  AND NOT (
    signature.identifier = 'a.out'