Linux Process Creation: Suspicious Git Clone Command with Vulnerability Keywords

title: "Linux Process Creation: Suspicious Git Clone Command with Vulnerability Keywords"
id: a86d214f-7f96-488e-9f9d-3f9d1858b6e2
status: test
description: This rule flags Linux process executions where the command line includes a remote repository clone action using git and the process image ends with /git. It further requires that the command line contains one or more vulnerability- or exploit-related keywords (e.g., CVE-, RCE, exploit, PoC). This matters because attackers often use git to pull proof-of-concept or exploit code, and keyword-matching helps surface suspicious cloning activity. Telemetry relies on process creation logs with Image and CommandLine fields.
references:
  - https://gist.githubusercontent.com/MichaelKoczwara/12faba9c061c12b5814b711166de8c2f/raw/e2068486692897b620c25fde1ea258c8218fe3d3/history.txt
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_susp_git_clone.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-01-03
modified: 2023-01-05
tags:
  - attack.reconnaissance
  - attack.t1593.003
logsource:
  category: process_creation
  product: linux
detection:
  selection_img:
    Image|endswith: /git
    CommandLine|contains: " clone "
  selection_keyword:
    CommandLine|contains:
      - exploit
      - Vulns
      - vulnerability
      - RCE
      - RemoteCodeExecution
      - Invoke-
      - CVE-
      - poc-
      - ProofOfConcept
      - proxyshell
      - log4shell
      - eternalblue
      - eternal-blue
      - MS17-
  condition: all of selection_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: cfec9d29-64ec-4a0f-9ffe-0fdb856d5446
    type: derived