@seph Hi. Do you know if it's possible to bind yara table to

bpf_process_events

instead of a

file_events

? Idea is to scan

path

of a process if such process has valid path

Not sure, I don’t use yara much