Linux process execution of git clone containing exploit or vulnerability keywords

title: Linux process execution of git clone containing exploit or vulnerability keywords
id: a86d214f-7f96-488e-9f9d-3f9d1858b6e2
status: test
description: This rule flags Linux process executions where the command line includes " git clone " and where the binary image path ends with "/git". It further requires the command line to contain one or more suspicious strings related to exploits, vulnerabilities, RCE, CVE identifiers, or known exploit PoC naming patterns. Attackers may use git cloning to pull and stage malicious code, and these keyword hits help identify suspicious cloning activity within process creation telemetry. The rule relies on Linux process creation fields such as the image path and full command line.
references:
  - https://gist.githubusercontent.com/MichaelKoczwara/12faba9c061c12b5814b711166de8c2f/raw/e2068486692897b620c25fde1ea258c8218fe3d3/history.txt
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_susp_git_clone.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-01-03
modified: 2023-01-05
tags:
  - attack.reconnaissance
  - attack.t1593.003
logsource:
  category: process_creation
  product: linux
detection:
  selection_img:
    Image|endswith: /git
    CommandLine|contains: " clone "
  selection_keyword:
    CommandLine|contains:
      - exploit
      - Vulns
      - vulnerability
      - RCE
      - RemoteCodeExecution
      - Invoke-
      - CVE-
      - poc-
      - ProofOfConcept
      - proxyshell
      - log4shell
      - eternalblue
      - eternal-blue
      - MS17-
  condition: all of selection_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: cfec9d29-64ec-4a0f-9ffe-0fdb856d5446
    type: derived