OpenCanary Detects Git Clone Requests on Git Service

Flags OpenCanary Git service logs showing a Git clone request, indicating possible repository access attempts.

FreeUnreviewedSigmahighv1

opencanary-detects-git-clone-requests-on-git-service-4fe17521

title: OpenCanary Detects Git Clone Requests on Git Service
id: 5c440589-3795-4c7b-8ecf-556a1674ff99
status: test
description: This rule identifies when an OpenCanary node’s Git service logs a Git clone request event. Such requests are commonly used by attackers to retrieve staged content, enumerate accessible repositories, or validate exposed services. The detection relies on OpenCanary application telemetry by matching the logged event type associated with clone requests.
references:
  - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration
  - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52
  - https://github.com/SigmaHQ/sigma/blob/master/rules/application/opencanary/opencanary_git_clone_request.yml
author: Security Onion Solutions, Huntrule Team
date: 2024-03-08
tags:
  - attack.collection
  - attack.t1213
logsource:
  category: application
  product: opencanary
detection:
  selection:
    logtype: 16001
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 4fe17521-aef3-4e6a-9d6b-4a7c8de155a8
    type: derived

What it detects

This rule identifies when an OpenCanary node’s Git service logs a Git clone request event. Such requests are commonly used by attackers to retrieve staged content, enumerate accessible repositories, or validate exposed services. The detection relies on OpenCanary application telemetry by matching the logged event type associated with clone requests.

Known false positives

Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.