Update process exclusions in TOML file

Author: Aegrah

rules/linux/persistence_shared_object_creation.toml

@@ -170,10 +170,10 @@ file.path:(
   process.name:(
     "dockerd" or "dpkg" or "rpm" or "snapd" or "yum" or "vmis-launcher" or "pacman" or "apt-get" or "dnf" or "podman" or
     platform-python* or "dnf-automatic" or "unattended-upgrade" or "apk" or "snap-update-ns" or "install" or "exe" or
-    "systemd" or "root" or "sshd" or "pip" or "jlink" or python* or "update-alternatives" or pip* or "crio" or
-    "ssm-agent-worker" or "packagekitd"
+    "systemd" or "root" or "sshd" or "pip" or "jlink" or python* or "update-alternatives" or pip* or "crio" or "packagekitd"
   ) or 
   (process.name:"vmware-install.pl" and file.path:/usr/lib/vmware-tools/*) or
+  (process.name:"ssm-agent-worker" and file.path:/usr/lib/jvm/java*) or 
   process.executable : (/dev/fd/* or "/" or "/kaniko/executor" or "/usr/bin/buildah")
 )
 '''