Installation
sudo cscli postoverflows install crowdsecurity/auditd-nvm-whitelist-processThen reload CrowdSec: sudo systemctl reload crowdsec
Sign in to see which of your engines run it →Configuration
Hover a line or a note to see what each field does.
name: crowdsecurity/auditd-nvm-whitelist-processdescription: "Whitelist node version manager"whitelist:reason: "node version manager"expression:- |evt.Overflow.Alert.GetScenario() == 'crowdsecurity/auditd-sus-exec' && all(evt.Overflow.Alert.Events, {.GetMeta('exe') matches '\\.nvm\\/versions\\/node\\/v(\\d+)\\.(\\d+)\\.(\\d+)\\/bin\\/node$'})
Installed on
Know where it runs
Sign in to see the Security Engines that run this postoverflow, the version they run and whether it was modified locally.
Documentation
nvm whitelist process
Since node version manager keep node and npm within a directory .nvm in the user's home directory, it will trigger our suspicious process detection. This postoverflow will whitelist the process node when they are executed from the .nvm directory.
This postoverflow is not supplied by default with auditd collection as you may not use nvm.