Update initial_access_execution_susp_react_serv_child.toml

Author: Samirbous

rules/cross-platform/initial_access_execution_susp_react_serv_child.toml

@@ -83,7 +83,7 @@ process.name in ("sh", "bash", "zsh", "curl", "wget", "id", "whoami", "uname", "
  ?process.working_directory : ("*react-dom*", "*.next*", "*node_modules/next*", "*react-server*", "*bin/next*", "*--experimental-https*", "*app/server*", "*.pnpm/next*", "*/app/*", "*next/dist/server*", "*react-scripts*") or
  
  (process.parent.name in ("node", "bun", "node.exe", "bun.exe") and
-  process.parent.command_line : ("*react-dom*", "*.next*", "*node_modules/next*", "*react-server*", "*bin/next*", "*--experimental-https*", "*app/server*", "*.pnpm/next*", "*next start*", "*next dev*", "*react-scripts start*", "*next/dist/server*"))
+  process.parent.command_line : ("*react-dom*", "*.next*", "*node_modules/next*", "*react-server*", "*next-server*", "*node server.js*", "*bin/next*", "*--experimental-https*", "*app/server*", "*.pnpm/next*", "*next start*", "*next dev*", "*react-scripts start*", "*next/dist/server*"))
  )
 '''