diff --git a/rules/falco_rules.yaml b/rules/falco_rules.yaml index 2975ce82..3c0cf030 100644 --- a/rules/falco_rules.yaml +++ b/rules/falco_rules.yaml @@ -443,7 +443,7 @@ proc.pcmdline startswith "node /opt/yarn/bin/yarn.js")) - macro: makefile_perl - condition: (proc.pcmdline="perl Makefile.PL") + condition: (proc.pcmdline startswith "perl Makefile.PL") - macro: parent_node_running_npm condition: (proc.pcmdline startswith "node /usr/local/bin/npm" or