Linux Process Creation: Suspicious Git Clone Command with Vulnerability Keywords
Alerts on Linux "git clone" commands that include exploit/vulnerability-related keywords or CVE/PoC-style terms.
- Product
- linux
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-01-03
- Updated
- 2026-07-31
ATT&CK techniques
ReconResource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Linux process executions where the command line includes a remote repository clone action using git and the process image ends with /git. It further requires that the command line contains one or more vulnerability- or exploit-related keywords (e.g., CVE-, RCE, exploit, PoC). This matters because attackers often use git to pull proof-of-concept or exploit code, and keyword-matching helps surface suspicious cloning activity. Telemetry relies on process creation logs with Image and CommandLine fields.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Linux Process Creation: Suspicious Git Clone Command with Vulnerability Keywords"
id: a86d214f-7f96-488e-9f9d-3f9d1858b6e2
status: test
description: This rule flags Linux process executions where the command line includes a remote repository clone action using git and the process image ends with /git. It further requires that the command line contains one or more vulnerability- or exploit-related keywords (e.g., CVE-, RCE, exploit, PoC). This matters because attackers often use git to pull proof-of-concept or exploit code, and keyword-matching helps surface suspicious cloning activity. Telemetry relies on process creation logs with Image and CommandLine fields.
references:
- https://gist.githubusercontent.com/MichaelKoczwara/12faba9c061c12b5814b711166de8c2f/raw/e2068486692897b620c25fde1ea258c8218fe3d3/history.txt
- https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_susp_git_clone.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-01-03
modified: 2023-01-05
tags:
- attack.reconnaissance
- attack.t1593.003
logsource:
category: process_creation
product: linux
detection:
selection_img:
Image|endswith: /git
CommandLine|contains: " clone "
selection_keyword:
CommandLine|contains:
- exploit
- Vulns
- vulnerability
- RCE
- RemoteCodeExecution
- Invoke-
- CVE-
- poc-
- ProofOfConcept
- proxyshell
- log4shell
- eternalblue
- eternal-blue
- MS17-
condition: all of selection_*
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: cfec9d29-64ec-4a0f-9ffe-0fdb856d5446
type: derived