From 558fbc20e2c7272af0e037de87acd1bd6a535f0e Mon Sep 17 00:00:00 2001
From: Linus Dierheimer <Linus@Dierheimer.de>
Date: Fri, 8 Jul 2022 11:24:11 +0200
Subject: [PATCH] Don't detect guake-wrapped as terminal

---
 src/detection/terminalShell.c | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/src/detection/terminalShell.c b/src/detection/terminalShell.c
index f42947823..d53e1ce18 100644
--- a/src/detection/terminalShell.c
+++ b/src/detection/terminalShell.c
@@ -69,12 +69,13 @@ static void getTerminalShell(FFTerminalShellResult* result, const char* pid)
 
     //Common programs that are between terminal and own process, but are not the shell
     if(
-        strcasecmp(name, "sudo")   == 0 ||
-        strcasecmp(name, "su")     == 0 ||
-        strcasecmp(name, "doas")   == 0 ||
-        strcasecmp(name, "strace") == 0 ||
-        strcasecmp(name, "sshd")   == 0 ||
-        strcasecmp(name, "gdb")    == 0
+        strcasecmp(name, "sudo")          == 0 ||
+        strcasecmp(name, "su")            == 0 ||
+        strcasecmp(name, "doas")          == 0 ||
+        strcasecmp(name, "strace")        == 0 ||
+        strcasecmp(name, "sshd")          == 0 ||
+        strcasecmp(name, "gdb")           == 0 ||
+        strcasecmp(name, "guake-wrapped") == 0
     ) {
         getTerminalShell(result, ppid);
         return;