diff --git a/detection/evasion/hidden-executable.sql b/detection/evasion/hidden-executable.sql
index 0c66fe4..c41d838 100644
--- a/detection/evasion/hidden-executable.sql
+++ b/detection/evasion/hidden-executable.sql
@@ -74,6 +74,7 @@ WHERE (
     '~/.pulumi',
     '~/Code',
     '~/code',
+    '~/.cursor',
     '~/Projects',
     '~/src',
     '~/.sdkman',
@@ -92,7 +93,6 @@ WHERE (
     '~/.config/bluejeans-v2',
     '~/.config/Code',
     '~/.config/nvm',
-    '~/.cursor',
     '~/.deno/bin',
     '~/.devpod/contexts',
     '~/.docker/cli-plugins',