updating based on Nas' comment (#4183)

Author: patel-bhavin

detections/endpoint/linux_apparmor_bypass_via_aaexec.yml

@@ -16,7 +16,7 @@ search: |-
         AND Processes.process="* -p *"
         AND Processes.process="*--*"
         AND Processes.process IN ("*trinity*","*chrome*","*flatpak*")
-        AND NOT Processes.process_path IN ("/user*","/opt*","/snap*","/var/lib/flatpak*")
+        AND NOT Processes.process IN ("/user*","/opt*","/snap*","/var/lib/flatpak*")
     by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec
     Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
     Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id