Update rules/cross-platform/credential_access_gitleaks_execution.toml

Co-authored-by: Samirbous <[email protected]>

Author: Aegrah

rules/cross-platform/credential_access_gitleaks_execution.toml

@@ -91,7 +91,7 @@ tags = [
 timestamp_override = "event.ingested"
 type = "eql"
 query = '''
-process where event.type == "start" and event.action in  ("exec", "exec_event", "start", "ProcessRollup2", "executed", "process_started") and
+process where event.type == "start" and event.action like ("exec", "exec_event", "start", "ProcessRollup2", "executed", "process_started", "Process Create*") and
 process.name : ("gitleaks.exe", "gitleaks")
 '''