From 413f91260d099dcf65c3fe6fad1ebc55bf454f17 Mon Sep 17 00:00:00 2001
From: Carter Li <zhangsongcui3371@sina.com>
Date: Fri, 19 Jan 2024 10:13:46 +0800
Subject: [PATCH] Processes (FreeBSD): don't count sub-threads as processes

---
 src/detection/processes/processes_bsd.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/src/detection/processes/processes_bsd.c b/src/detection/processes/processes_bsd.c
index bc8cdaaeb..0cd169cfa 100644
--- a/src/detection/processes/processes_bsd.c
+++ b/src/detection/processes/processes_bsd.c
@@ -6,13 +6,17 @@
     #include <sys/user.h>
 #endif
 
+#ifndef KERN_PROC_PROC
+    #define KERN_PROC_PROC KERN_PROC_ALL // Apple
+#endif
+
 const char* ffDetectProcesses(uint32_t* result)
 {
-    int request[] = {CTL_KERN, KERN_PROC, KERN_PROC_ALL};
+    int request[] = {CTL_KERN, KERN_PROC, KERN_PROC_PROC};
     size_t length;
 
     if(sysctl(request, sizeof(request) / sizeof(*request), NULL, &length, NULL, 0) != 0)
-        return "sysctl({CTL_KERN, KERN_PROC, KERN_PROC_ALL}) failed";
+        return "sysctl({CTL_KERN, KERN_PROC, KERN_PROC_PROC}) failed";
 
     *result = (uint32_t)(length / sizeof(struct kinfo_proc));
     return NULL;