diff --git a/x-pack/plugins/security_solution/common/utils/path_placeholder.test.ts b/x-pack/plugins/security_solution/common/utils/path_placeholder.test.ts
new file mode 100644
index 0000000000000..f79a164e7d4fe
--- /dev/null
+++ b/x-pack/plugins/security_solution/common/utils/path_placeholder.test.ts
@@ -0,0 +1,69 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { getPlaceholderText, placeholderText } from './path_placeholder';
+import { ConditionEntryField, OperatingSystem, TrustedAppEntryTypes } from '../endpoint/types';
+
+const trustedAppEntry = {
+  os: OperatingSystem.LINUX,
+  field: ConditionEntryField.HASH,
+  type: 'match' as TrustedAppEntryTypes,
+};
+
+describe('Trusted Apps: Path placeholder text', () => {
+  it('returns no placeholder text when field IS NOT PATH', () => {
+    expect(getPlaceholderText({ ...trustedAppEntry })).toEqual(undefined);
+  });
+
+  it('returns a placeholder text when field IS PATH', () => {
+    expect(getPlaceholderText({ ...trustedAppEntry, field: ConditionEntryField.PATH })).toEqual(
+      placeholderText.others.exact
+    );
+  });
+
+  it('returns LINUX/MAC equivalent placholder when field IS PATH', () => {
+    expect(
+      getPlaceholderText({
+        ...trustedAppEntry,
+        os: OperatingSystem.MAC,
+        field: ConditionEntryField.PATH,
+      })
+    ).toEqual(placeholderText.others.exact);
+  });
+
+  it('returns LINUX/MAC equivalent placholder text when field IS PATH and WILDCARD operator is selected', () => {
+    expect(
+      getPlaceholderText({
+        ...trustedAppEntry,
+        os: OperatingSystem.LINUX,
+        field: ConditionEntryField.PATH,
+        type: 'wildcard',
+      })
+    ).toEqual(placeholderText.others.wildcard);
+  });
+
+  it('returns WINDOWS equivalent placholder text when field IS PATH', () => {
+    expect(
+      getPlaceholderText({
+        ...trustedAppEntry,
+        os: OperatingSystem.WINDOWS,
+        field: ConditionEntryField.PATH,
+      })
+    ).toEqual(placeholderText.windows.exact);
+  });
+
+  it('returns WINDOWS equivalent placholder text when field IS PATH and WILDCARD operator is selected', () => {
+    expect(
+      getPlaceholderText({
+        ...trustedAppEntry,
+        os: OperatingSystem.WINDOWS,
+        field: ConditionEntryField.PATH,
+        type: 'wildcard',
+      })
+    ).toEqual(placeholderText.windows.wildcard);
+  });
+});
diff --git a/x-pack/plugins/security_solution/common/utils/path_placeholder.ts b/x-pack/plugins/security_solution/common/utils/path_placeholder.ts
new file mode 100644
index 0000000000000..ee38ec11781d1
--- /dev/null
+++ b/x-pack/plugins/security_solution/common/utils/path_placeholder.ts
@@ -0,0 +1,43 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { ConditionEntryField, OperatingSystem, TrustedAppEntryTypes } from '../endpoint/types';
+
+export const placeholderText = {
+  windows: {
+    wildcard: 'C:\\sample\\**\\*',
+    exact: 'C:\\sample\\path.exe',
+  },
+  others: {
+    wildcard: '/opt/**/*',
+    exact: '/opt/bin',
+  },
+};
+
+export const getPlaceholderText = ({
+  os,
+  field,
+  type,
+}: {
+  os: OperatingSystem;
+  field: ConditionEntryField;
+  type: TrustedAppEntryTypes;
+}): string | undefined => {
+  if (field === ConditionEntryField.PATH) {
+    if (os === OperatingSystem.WINDOWS) {
+      if (type === 'wildcard') {
+        return placeholderText.windows.wildcard;
+      }
+      return placeholderText.windows.exact;
+    } else {
+      if (type === 'wildcard') {
+        return placeholderText.others.wildcard;
+      }
+      return placeholderText.others.exact;
+    }
+  }
+};
diff --git a/x-pack/plugins/security_solution/public/management/pages/trusted_apps/view/components/condition_entry_input/index.tsx b/x-pack/plugins/security_solution/public/management/pages/trusted_apps/view/components/condition_entry_input/index.tsx
index 8314cdce9b38f..1f2892116908e 100644
--- a/x-pack/plugins/security_solution/public/management/pages/trusted_apps/view/components/condition_entry_input/index.tsx
+++ b/x-pack/plugins/security_solution/public/management/pages/trusted_apps/view/components/condition_entry_input/index.tsx
@@ -31,6 +31,7 @@ import {
   OPERATOR_TITLES,
 } from '../../translations';
 import { useTestIdGenerator } from '../../../../../components/hooks/use_test_id_generator';
+import { getPlaceholderText } from '../../../../../../../common/utils/path_placeholder';
 
 const ConditionEntryCell = memo<{
   showLabel: boolean;
@@ -191,17 +192,11 @@ export const ConditionEntryInput = memo<ConditionEntryInputProps>(
             <EuiFieldText
               name="value"
               value={entry.value}
-              placeholder={
-                entry.field === ConditionEntryField.PATH
-                  ? entry.type === 'wildcard'
-                    ? os === OperatingSystem.WINDOWS
-                      ? `C:\\sample\\**\\*`
-                      : `/opt/**/*`
-                    : os === OperatingSystem.WINDOWS
-                    ? `C:\\sample\\path.exe`
-                    : `/opt/bin/`
-                  : undefined
-              }
+              placeholder={getPlaceholderText({
+                os,
+                field: entry.field,
+                type: entry.type,
+              })}
               fullWidth
               required
               onChange={handleValueUpdate}