diff --git a/src/detection/terminalshell/terminalshell.h b/src/detection/terminalshell/terminalshell.h
index 921fb7098..0ba1cb227 100644
--- a/src/detection/terminalshell/terminalshell.h
+++ b/src/detection/terminalshell/terminalshell.h
@@ -5,8 +5,9 @@
 typedef struct FFShellResult
 {
     FFstrbuf processName;
-    FFstrbuf exe;
+    FFstrbuf exe; //Actually arg0
     const char* exeName; //pointer to a char in exe
+    FFstrbuf exePath; //Full real path to executable file
     FFstrbuf prettyName;
     FFstrbuf version;
     uint32_t pid;
@@ -19,6 +20,7 @@ typedef struct FFTerminalResult
     FFstrbuf exe;
     FFstrbuf prettyName;
     const char* exeName; //pointer to a char in exe
+    FFstrbuf exePath; //Full real path to executable file
     FFstrbuf version;
     uint32_t pid;
     uint32_t ppid;
diff --git a/src/detection/terminalshell/terminalshell_linux.c b/src/detection/terminalshell/terminalshell_linux.c
index e3440cd05..ed40f3773 100644
--- a/src/detection/terminalshell/terminalshell_linux.c
+++ b/src/detection/terminalshell/terminalshell_linux.c
@@ -24,7 +24,7 @@ static void setExeName(FFstrbuf* exe, const char** exeName)
         *exeName = exe->chars + lastSlashIndex + 1;
 }
 
-static void getProcessInformation(pid_t pid, FFstrbuf* processName, FFstrbuf* exe, const char** exeName)
+static void getProcessInformation(pid_t pid, FFstrbuf* processName, FFstrbuf* exe, const char** exeName, FFstrbuf* exePath)
 {
     assert(processName->length > 0);
     ffStrbufClear(exe);
@@ -55,7 +55,9 @@ static void getProcessInformation(pid_t pid, FFstrbuf* processName, FFstrbuf* ex
             const char* realExePath = procArgs2 + sizeof(argc);
 
             const char* arg0 = memchr(realExePath, '\0', len - (size_t) (realExePath - procArgs2));
-            while (*arg0 == '\0') arg0++;
+            ffStrbufSetNS(exePath, (uint32_t) (arg0 - realExePath), realExePath);
+
+            do arg0++; while (*arg0 == '\0');
             assert(arg0 < procArgs2 + len);
             if (*arg0 == '-') arg0++; // Login shells
 
@@ -192,7 +194,7 @@ static pid_t getShellInfo(FFShellResult* result, pid_t pid)
         result->pid = (uint32_t) pid;
         result->ppid = (uint32_t) ppid;
         ffStrbufSetS(&result->processName, name);
-        getProcessInformation(pid, &result->processName, &result->exe, &result->exeName);
+        getProcessInformation(pid, &result->processName, &result->exe, &result->exeName, &result->exePath);
         break;
     }
     return ppid;
@@ -245,7 +247,7 @@ static pid_t getTerminalInfo(FFTerminalResult* result, pid_t pid)
         result->pid = (uint32_t) pid;
         result->ppid = (uint32_t) ppid;
         ffStrbufSetS(&result->processName, name);
-        getProcessInformation(pid, &result->processName, &result->exe, &result->exeName);
+        getProcessInformation(pid, &result->processName, &result->exe, &result->exeName, &result->exePath);
         break;
     }
     return ppid;
@@ -417,7 +419,6 @@ static void setTerminalInfoDetails(FFTerminalResult* result)
     else
         ffStrbufInitCopy(&result->prettyName, &result->processName);
 
-    ffStrbufInit(&result->version);
     fftsGetTerminalVersion(&result->processName, &result->exe, &result->version);
 }
 
@@ -440,6 +441,7 @@ const FFShellResult* ffDetectShell()
     ffStrbufInit(&result.processName);
     ffStrbufInitA(&result.exe, FF_EXE_PATH_LEN);
     result.exeName = result.exe.chars;
+    ffStrbufInit(&result.exePath);
     ffStrbufInit(&result.version);
     result.pid = 0;
     result.ppid = 0;
@@ -463,6 +465,8 @@ const FFTerminalResult* ffDetectTerminal()
     ffStrbufInit(&result.processName);
     ffStrbufInitA(&result.exe, FF_EXE_PATH_LEN);
     result.exeName = result.exe.chars;
+    ffStrbufInit(&result.exePath);
+    ffStrbufInit(&result.version);
     result.pid = 0;
     result.ppid = 0;
 
diff --git a/src/modules/shell/shell.c b/src/modules/shell/shell.c
index 0c6d82f8c..a0792d5c2 100644
--- a/src/modules/shell/shell.c
+++ b/src/modules/shell/shell.c
@@ -38,6 +38,7 @@ void ffPrintShell(FFShellOptions* options)
             {FF_FORMAT_ARG_TYPE_STRBUF, &result->version},
             {FF_FORMAT_ARG_TYPE_UINT, &result->pid},
             {FF_FORMAT_ARG_TYPE_STRBUF, &result->prettyName},
+            {FF_FORMAT_ARG_TYPE_STRBUF, &result->exePath},
         });
     }
 }
@@ -90,6 +91,7 @@ void ffGenerateShellJsonResult(FF_MAYBE_UNUSED FFShellOptions* options, yyjson_m
     yyjson_mut_val* obj = yyjson_mut_obj_add_obj(doc, module, "result");
     yyjson_mut_obj_add_strbuf(doc, obj, "exe", &result->exe);
     yyjson_mut_obj_add_strcpy(doc, obj, "exeName", result->exeName);
+    yyjson_mut_obj_add_strbuf(doc, obj, "exePath", &result->exePath);
     yyjson_mut_obj_add_uint(doc, obj, "pid", result->pid);
     yyjson_mut_obj_add_uint(doc, obj, "ppid", result->ppid);
     yyjson_mut_obj_add_strbuf(doc, obj, "processName", &result->processName);
@@ -101,11 +103,12 @@ void ffPrintShellHelpFormat(void)
 {
     ffPrintModuleFormatHelp(FF_SHELL_MODULE_NAME, "{3} {4}", FF_SHELL_NUM_FORMAT_ARGS, (const char* []) {
         "Shell process name",
-        "Shell path with exe name",
-        "Shell exe name",
+        "The first argument of the command line when running the shell",
+        "Shell base name of arg0",
         "Shell version",
         "Shell pid",
-        "Shell pretty name"
+        "Shell pretty name",
+        "Shell full exe path",
     });
 }
 
diff --git a/src/modules/terminal/terminal.c b/src/modules/terminal/terminal.c
index d456ea771..c5295d5bb 100644
--- a/src/modules/terminal/terminal.c
+++ b/src/modules/terminal/terminal.c
@@ -6,7 +6,7 @@
 
 #include <string.h>
 
-#define FF_TERMINAL_NUM_FORMAT_ARGS 6
+#define FF_TERMINAL_NUM_FORMAT_ARGS 7
 
 void ffPrintTerminal(FFTerminalOptions* options)
 {
@@ -36,6 +36,7 @@ void ffPrintTerminal(FFTerminalOptions* options)
             {FF_FORMAT_ARG_TYPE_UINT, &result->pid},
             {FF_FORMAT_ARG_TYPE_STRBUF, &result->prettyName},
             {FF_FORMAT_ARG_TYPE_STRBUF, &result->version},
+            {FF_FORMAT_ARG_TYPE_STRBUF, &result->exePath},
         });
     }
 }
@@ -89,6 +90,7 @@ void ffGenerateTerminalJsonResult(FF_MAYBE_UNUSED FFTerminalOptions* options, yy
     yyjson_mut_obj_add_strbuf(doc, obj, "processName", &result->processName);
     yyjson_mut_obj_add_strbuf(doc, obj, "exe", &result->exe);
     yyjson_mut_obj_add_strcpy(doc, obj, "exeName", result->exeName);
+    yyjson_mut_obj_add_strbuf(doc, obj, "exePath", &result->exePath);
     yyjson_mut_obj_add_uint(doc, obj, "pid", result->pid);
     yyjson_mut_obj_add_uint(doc, obj, "ppid", result->ppid);
     yyjson_mut_obj_add_strbuf(doc, obj, "prettyName", &result->prettyName);
@@ -99,11 +101,12 @@ void ffPrintTerminalHelpFormat(void)
 {
     ffPrintModuleFormatHelp(FF_TERMINAL_MODULE_NAME, "{5} {6}", FF_TERMINAL_NUM_FORMAT_ARGS, (const char* []) {
         "Terminal process name",
-        "Terminal path with exe name",
-        "Terminal exe name",
+        "The first argument of the command line when running the terminal",
+        "Terminal base name of arg0",
         "Terminal pid",
         "Terminal pretty name",
-        "Terminal version"
+        "Terminal version",
+        "Terminal full exe path",
     });
 }