From 999f2170fe96616917ebdab4fa2dc372b8d3839f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E6=9D=8E=E9=80=9A=E6=B4=B2?= Date: Fri, 26 Jan 2024 09:53:12 +0800 Subject: [PATCH] Terminal: ignore `sshd` --- src/detection/terminalshell/terminalshell_linux.c | 1 + 1 file changed, 1 insertion(+) diff --git a/src/detection/terminalshell/terminalshell_linux.c b/src/detection/terminalshell/terminalshell_linux.c index 02a86baa9..32ded8311 100644 --- a/src/detection/terminalshell/terminalshell_linux.c +++ b/src/detection/terminalshell/terminalshell_linux.c @@ -284,6 +284,7 @@ static pid_t getTerminalInfo(FFTerminalResult* result, pid_t pid) ffStrEquals(name, "oil.ovm") || ffStrEquals(name, "xonsh") || // works in Linux but not in macOS because kernel returns `Python` in this case ffStrEquals(name, "login") || + ffStrEquals(name, "sshd") || ffStrEndsWith(name, ".sh") ) {