Sigma rule: Suspicious Git Clone

Rule

Title

Suspicious Git Clone

Status

test

Level

medium

Author

Nasreddine Bencherchali (Nextron Systems)

Date

2023-01-03

Modified

2023-01-10

File

rules/windows/process_creation/proc_creation_win_git_susp_clone.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects execution of "git" in order to clone a remote repository that contain suspicious keywords which might be suspicious

Log source

product

windows

category

process_creation

Detection

selection_img:
    - Image|endswith:
          - '\git.exe'
          - '\git-remote-https.exe'
    - OriginalFileName: 'git.exe'
selection_cli:
    CommandLine|contains:
        - ' clone '
        - 'git-remote-https '
selection_keyword:
    CommandLine|contains:
        # Add more suspicious keywords
        - 'exploit'
        - 'Vulns'
        - 'vulnerability'
        - 'RemoteCodeExecution'
        - 'Invoke-'
        - 'CVE-'
        - 'poc-'
        - 'ProofOfConcept'
        # Add more vuln names
        - 'proxyshell'
        - 'log4shell'
        - 'eternalblue'
        - 'eternal-blue'
        - 'MS17-'
condition: all of selection_*

False positives (as the rule lists them)

• Unknown

Tags

• attack.reconnaissance
• attack.t1593.003

MITRE ATT&CK ids this rule names

• T1593.003

References

• https://gist.githubusercontent.com/MichaelKoczwara/12faba9c061c12b5814b711166de8c2f/raw/e2068486692897b620c25fde1ea258c8218fe3d3/history.txt

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_creation/proc_creation_win_git_susp_clone.yml