Add node and java to unusual command execution rule

Author: Aegrah

rules/linux/persistence_web_server_unusual_command_execution.toml

@@ -36,7 +36,7 @@ event.category:process and host.os.type:linux and event.type:start and event.act
     "apache" or "nginx" or "apache2" or "httpd" or "lighttpd" or "caddy" or "mongrel_rails" or "haproxy" or
     "gunicorn" or "uwsgi" or "openresty" or "cherokee" or "h2o" or "resin" or "puma" or "unicorn" or "traefik" or "uvicorn" or
     "tornado" or "hypercorn" or "daphne" or "twistd" or "yaws" or "webfsd" or "httpd.worker" or "flask" or "rails" or "mongrel" or
-    php* or ruby* or perl* or python*
+    php* or ruby* or perl* or python* or "node" or "java"
   ) or
   user.name:("apache" or "www-data" or "httpd" or "nginx" or "lighttpd" or "tomcat" or "tomcat8" or "tomcat9") or
   user.id:("33" or "498" or "48" or "54321")
@@ -53,7 +53,7 @@ event.category:process and host.os.type:linux and event.type:start and event.act
 ) and
 process.command_line:* and process.name:(bash or dash or sh or tcsh or csh or zsh or ksh or fish) and process.args:"-c" and
 not (
-  (process.parent.name:java and process.parent.executable:/u0*/*) or
+  (process.parent.name:java and not process.parent.executable:/u0*/*) or
   (process.parent.name:python* and process.parent.executable:(/bin/python* or /usr/bin/python* or /usr/local/bin/python* or /tmp/*python* or /opt/oracle.ahf/python/*)) or
   (process.parent.name:ruby* and process.parent.executable:(/bin/ruby* or /usr/bin/ruby* or /usr/local/bin/ruby* or /tmp/*ruby* or /bin/ruby or /usr/bin/ruby or /usr/local/bin/ruby)) or
   (process.parent.name:perl* and process.parent.executable:(/bin/perl* or /usr/bin/perl* or /usr/local/bin/perl* or /tmp/*perl* or /bin/perl or /usr/bin/perl or /usr/local/bin/perl)) or