cscli postoverflows install crowdsecurity/auditd-nvm-whitelist-processSince node version manager keep node and npm within a directory .nvm in the user's home directory, it will trigger our suspicious process detection. This postoverflow will whitelist the process node when they are executed from the .nvm directory.
This postoverflow is not supplied by default with auditd collection as you may not use nvm.
1name: crowdsecurity/auditd-nvm-whitelist-process2description: "Whitelist node version manager"3whitelist:4 reason: "node version manager"5 expression:6 - |7 evt.Overflow.Alert.GetScenario() == 'crowdsecurity/auditd-sus-exec' && all(evt.Overflow.Alert.Events, {.GetMeta('exe') matches '\\.nvm\\/versions\\/node\\/v(\\d+)\\.(\\d+)\\.(\\d+)\\/bin\\/node$'})