Update rules/cross-platform/execution_aws_ec2_lolbin_via_ssm.toml

Author: terrancedejesus

rules/cross-platform/execution_aws_ec2_lolbin_via_ssm.toml

@@ -109,7 +109,7 @@ FROM logs-aws.cloudtrail*, logs-endpoint.* METADATA _id, _version, _index
     AND host.os.type == "linux"
     AND (
       // SSM shell (_script.sh) runner
-      process.command_line LIKE "*/document/orchestration/%/awsrunShellScript/*/_script.sh"
+      process.command_line LIKE "*/document/orchestration/*/awsrunShellScript/*/_script.sh"
       // LOLBins / GTFOBins
       OR process.executable IN (
         "/usr/bin/base64",