1.24.22 — Ignore non-exec firewall Audit records

2026-09-09

MojoSec now excludes explicit non-exec NETFILTER syscall compounds that reuse a firewall child PID from the process-generation proof graph, while managed and unknown exec evidence stays conservative.

Fixed

• Prevented same-PID NETFILTER Audit activity from vetoing an otherwise proven firewall execution.