From fea55b276edccc93e987c4d5cecf02c24d5d4f93 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E6=9D=8E=E9=80=9A=E6=B4=B2?= <zhangsongcui3371@sina.com>
Date: Sun, 20 Sep 2026 16:25:52 +0800
Subject: [PATCH] Terminal (Windows): ignores `services`; fixes ssh env
 detection

---
 src/detection/terminalshell/terminalshell_windows.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/src/detection/terminalshell/terminalshell_windows.c b/src/detection/terminalshell/terminalshell_windows.c
index 08cdb17ba..92b20afb3 100644
--- a/src/detection/terminalshell/terminalshell_windows.c
+++ b/src/detection/terminalshell/terminalshell_windows.c
@@ -123,8 +123,8 @@ static bool getTerminalFromEnv(FFTerminalResult* result) {
     }
 
     // SSH
-    if (getenv("SSH_TTY") != nullptr) {
-        term = getenv("SSH_TTY");
+    if (getenv("SSH_CONNECTION") != nullptr) {
+        term = "sshd"; // No SSH_TTY on Windows
     }
 
     // Windows Terminal
@@ -253,7 +253,8 @@ static uint32_t getTerminalInfo(FFTerminalResult* result, uint32_t pid) {
 
         if (ffStrbufIgnCaseEqualS(&result->prettyName, "sihost") ||
             ffStrbufIgnCaseEqualS(&result->prettyName, "explorer") ||
-            ffStrbufIgnCaseEqualS(&result->prettyName, "wininit")) {
+            ffStrbufIgnCaseEqualS(&result->prettyName, "wininit") ||
+            ffStrbufIgnCaseEqualS(&result->prettyName, "services")) {
             // A CUI program created by Windows Explorer will spawn a conhost as its child.
             // However the conhost process is just a placeholder;
             // The true terminal can be Windows Terminal or others.