You can certainly make use of the file /etc/csf/csf.pignore which can be used to whitelist either usernames or full paths to binaries. Care should be taken with ignoring users or files so that you don’t force false-negatives.
You must use the following format: exe:/full/path/to/file user:username cmd:command line