diff --git a/rules/falco_rules.yaml b/rules/falco_rules.yaml
index 5c4865c8..71b94354 100644
--- a/rules/falco_rules.yaml
+++ b/rules/falco_rules.yaml
@@ -871,7 +871,7 @@
     nginx_control, mailmng-service, web_statistic_e, statistics_coll, install-info,
     hawkular-metric, rhsmcertd-worke, parted, amuled, fluentd, x2gormforward,
     parallels_insta, salt-minion, dnsmng, update-inetd, pum_worker, awstats_buildst,
-    tsvuln, 50plesk-daily, grubby, chkconfig, dracut-install, rhnsd
+    tsvuln, 50plesk-daily, grubby, chkconfig, dracut-install, rhnsd, find
     ]
 
 - rule: Run shell untrusted