Update linux_suspicious_react_or_next_js_child_process.yml

Author: nasbench

detections/endpoint/linux_suspicious_react_or_next_js_child_process.yml

@@ -50,6 +50,14 @@ search: |
           Processes.process_name IN ("curl", "wget")
           Processes.process = "*|*"
         )
+        OR (
+          Processes.process_name IN (
+            "bash",
+            "dash",
+            "sh"
+          )
+          NOT Processes.process = "*-c*"
+        )
         OR (
           Processes.process_name IN (
             "bash",