From 2e46b5932ed22999310a230667c4b92ec1f0def2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E6=9D=8E=E9=80=9A=E6=B4=B2?= <zhangsongcui3371@sina.com>
Date: Sat, 18 Nov 2023 16:33:40 +0800
Subject: [PATCH] Terminal (Windows): ignore the shell warpper
 `servercoreshell`

---
 src/detection/terminalshell/terminalshell_windows.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/detection/terminalshell/terminalshell_windows.c b/src/detection/terminalshell/terminalshell_windows.c
index 06ef8c573..04a3afecb 100644
--- a/src/detection/terminalshell/terminalshell_windows.c
+++ b/src/detection/terminalshell/terminalshell_windows.c
@@ -305,6 +305,7 @@ static uint32_t getTerminalInfo(FFTerminalShellResult* result, uint32_t pid)
         ffStrbufIgnCaseEqualS(&result->terminalPrettyName, "powershell")     ||
         ffStrbufIgnCaseEqualS(&result->terminalPrettyName, "powershell_ise") ||
         ffStrbufIgnCaseEqualS(&result->terminalPrettyName, "wsl")            || // running inside wsl
+        ffStrbufIgnCaseEqualS(&result->terminalPrettyName, "servercoreshell")   || // ServerCore Shell Launcher
         ffStrbufStartsWithIgnCaseS(&result->terminalPrettyName, "ConEmuC") // wrapper process of ConEmu
     ) {
         //We are nested shell