Update rules/cross-platform/execution_nodejs_pre_or_post_install_script_execution.toml

Author: Aegrah

rules/cross-platform/execution_nodejs_pre_or_post_install_script_execution.toml

@@ -67,7 +67,7 @@ type = "eql"
 query = '''
 sequence by host.id with maxspan=10s
   [process where host.os.type in ("linux", "macos") and event.type == "start" and event.action in ("exec", "ProcessRollup2", "start") and process.name == "node" and process.args == "install"] by process.entity_id
-  [process where host.os.type in ("linux", "macos") and event.type == "start" and event.action in ("exec", "ProcessRollup2") and process.parent.name == "node"] by process.parent.entity_id
+  [process where host.os.type in ("linux", "macos") and event.type == "start" and event.action in ("exec", "ProcessRollup2", "start") and process.parent.name == "node"] by process.parent.entity_id
 '''
 
 [[rule.threat]]