Add elastic-endpoint

Signed-off-by: egibs <20933572+egibs@users.noreply.github.com>
2024-11-20 14:02:05 -06:00 · 2024-11-20 14:02:05 -06:00 · 78ec36eca0
parent a24c3d2333
commit 78ec36eca0
1 changed files with 1 additions and 0 deletions
--- a/detection/evasion/touched-executable-linux.sql
+++ b/detection/evasion/touched-executable-linux.sql
@ -57,5 +57,6 @@ WHERE
  AND f.path NOT LIKE '%/go/bin/%'
  AND f.path NOT LIKE '%/osqueryi'
  AND f.path NOT LIKE '/tmp/%/.terraform/providers/%'
+  AND f.path NOT LIKE '/var/opt/Elastic/Endpoint/elastic-endpoint'
 GROUP by
  p.pid