Windows Process Creation: git Clone with Vulnerability/Payload Keywords

title: "Windows Process Creation: git Clone with Vulnerability/Payload Keywords"
id: 10b555df-1b1c-473d-b8be-91a1d885d9bc
status: test
description: This rule identifies suspicious use of git on Windows where a remote clone operation is initiated and the command line contains vulnerability- or exploit-related keywords. Attackers may use cloned repositories to retrieve proof-of-concept code, payloads, or exploit tooling after discovery or targeting. The detection relies on Windows process creation telemetry, matching the executable name/path for git variants and analyzing the command line for both clone indicators and suspicious keyword strings.
references:
  - https://gist.githubusercontent.com/MichaelKoczwara/12faba9c061c12b5814b711166de8c2f/raw/e2068486692897b620c25fde1ea258c8218fe3d3/history.txt
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_git_susp_clone.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-01-03
modified: 2023-01-10
tags:
  - attack.reconnaissance
  - attack.t1593.003
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith:
        - \git.exe
        - \git-remote-https.exe
    - OriginalFileName: git.exe
  selection_cli:
    CommandLine|contains:
      - " clone "
      - "git-remote-https "
  selection_keyword:
    CommandLine|contains:
      - exploit
      - Vulns
      - vulnerability
      - RemoteCodeExecution
      - Invoke-
      - CVE-
      - poc-
      - ProofOfConcept
      - proxyshell
      - log4shell
      - eternalblue
      - eternal-blue
      - MS17-
  condition: all of selection_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: aef9d1f1-7396-4e92-a927-4567c7a495c1
    type: derived