Update process name conditions for suspicious execution

Author: Aegrah

rules/linux/execution_suspicious_pod_or_container_creation_command_execution.toml

@@ -46,7 +46,7 @@ type = "eql"
 query = '''
 process where host.os.type == "linux" and event.type == "start" and event.action in ("exec", "exec_event", "start", "ProcessRollup2", "executed", "process_started") and (
   (process.name == "kubectl" and process.args == "run" and process.args == "--restart=Never" and process.args == "--") or
-  (process.name == "docker" and process.args == "run")
+  (process.name in ("docker", "nerdctl", "ctl") and process.args == "run")
 ) and 
 process.args in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish") and
 process.command_line like~ (