diff --git a/src/detection/terminalshell/terminalshell.c b/src/detection/terminalshell/terminalshell.c
index cfaede137..86c7f2e67 100644
--- a/src/detection/terminalshell/terminalshell.c
+++ b/src/detection/terminalshell/terminalshell.c
@@ -98,6 +98,36 @@ static bool getShellVersionPwsh(FFstrbuf* exe, FFstrbuf* version)
     return true;
 }
 
+static bool getShellVersionKsh(FFstrbuf* exe, FFstrbuf* version)
+{
+    if(ffProcessAppendStdErr(version, (char* const[]) {
+        exe->chars,
+        "--version",
+        NULL
+    }) != NULL)
+        return false;
+
+    //  version         sh (AT&T Research) 93u+ 2012-08-01
+    ffStrbufSubstrAfterLastC(version, ')');
+    ffStrbufTrim(version, ' ');
+    return true;
+}
+
+static bool getShellVersionOksh(FFstrbuf* exe, FFstrbuf* version)
+{
+    if(ffProcessAppendStdOut(version, (char* const[]) {
+        exe->chars,
+        "-c",
+        "echo $OKSH_VERSION",
+        NULL
+    }) != NULL)
+        return false;
+
+    //oksh 7.3
+    ffStrbufSubstrAfterFirstC(version, ' ');
+    return true;
+}
+
 #ifdef _WIN32
 static bool getShellVersionWinPowerShell(FFstrbuf* exe, FFstrbuf* version)
 {
@@ -129,6 +159,10 @@ bool fftsGetShellVersion(FFstrbuf* exe, const char* exeName, FFstrbuf* version)
         return getExeVersionGeneral(exe, version); //tcsh 6.24.07 (Astron) 2022-12-21 (aarch64-apple-darwin) options wide,nls,dl,al,kan,sm,rh,color,filec
     if(strcasecmp(exeName, "nu") == 0)
         return getExeVersionRaw(exe, version); //0.73.0
+    if(strcasecmp(exeName, "ksh") == 0)
+        return getShellVersionKsh(exe, version);
+    if(strcasecmp(exeName, "oksh") == 0)
+        return getShellVersionOksh(exe, version);
     if(strcasecmp(exeName, "python") == 0 && getenv("XONSH_VERSION"))
     {
         ffStrbufSetS(version, getenv("XONSH_VERSION"));
diff --git a/src/detection/terminalshell/terminalshell_linux.c b/src/detection/terminalshell/terminalshell_linux.c
index 91852519e..5d578fff3 100644
--- a/src/detection/terminalshell/terminalshell_linux.c
+++ b/src/detection/terminalshell/terminalshell_linux.c
@@ -152,6 +152,8 @@ static void getTerminalShell(FFTerminalShellResult* result, pid_t pid)
         strcasecmp(name, "bash")      == 0 ||
         strcasecmp(name, "zsh")       == 0 ||
         strcasecmp(name, "ksh")       == 0 ||
+        strcasecmp(name, "mksh")      == 0 ||
+        strcasecmp(name, "oksh")      == 0 ||
         strcasecmp(name, "csh")       == 0 ||
         strcasecmp(name, "tcsh")      == 0 ||
         strcasecmp(name, "fish")      == 0 ||