Add elastic-endpoint

Signed-off-by: egibs <20933572+egibs@users.noreply.github.com>
chainguard-dev · Nov 20, 2024 · 78ec36e · 78ec36e
1 parent a24c3d2
commit 78ec36e
Showing 1 changed file with 1 addition and 0 deletions.
diff --git a/detection/evasion/touched-executable-linux.sql b/detection/evasion/touched-executable-linux.sql
@@ -57,5 +57,6 @@ WHERE
   AND f.path NOT LIKE '%/go/bin/%'
   AND f.path NOT LIKE '%/osqueryi'
   AND f.path NOT LIKE '/tmp/%/.terraform/providers/%'
+  AND f.path NOT LIKE '/var/opt/Elastic/Endpoint/elastic-endpoint'
 GROUP by
   p.pid