Windows Process Creation: Suspicious Git Clone Command With Vulnerability Keywords
Flags Windows git clone commands that include exploit/vulnerability-style keywords in the process command line.
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-01-03
- Updated
- 2026-07-31
ATT&CK techniques
ReconResource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows process creation events where git is executed (including git.exe or git-remote-https.exe) and the command line includes a git clone action. It further requires the command line to contain one or more vulnerability- or exploit-related keywords (for example, exploit, CVE-, ProofOfConcept, and common named CVEs). This matters because attackers may use cloning of remote repositories to stage or distribute exploit tooling. The detection relies on process creation telemetry capturing the Image/OriginalFileName and the full CommandLine.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Process Creation: Suspicious Git Clone Command With Vulnerability Keywords"
id: 10b555df-1b1c-473d-b8be-91a1d885d9bc
status: test
description: This rule flags Windows process creation events where git is executed (including git.exe or git-remote-https.exe) and the command line includes a git clone action. It further requires the command line to contain one or more vulnerability- or exploit-related keywords (for example, exploit, CVE-, ProofOfConcept, and common named CVEs). This matters because attackers may use cloning of remote repositories to stage or distribute exploit tooling. The detection relies on process creation telemetry capturing the Image/OriginalFileName and the full CommandLine.
references:
- https://gist.githubusercontent.com/MichaelKoczwara/12faba9c061c12b5814b711166de8c2f/raw/e2068486692897b620c25fde1ea258c8218fe3d3/history.txt
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_git_susp_clone.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-01-03
modified: 2023-01-10
tags:
- attack.reconnaissance
- attack.t1593.003
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith:
- \git.exe
- \git-remote-https.exe
- OriginalFileName: git.exe
selection_cli:
CommandLine|contains:
- " clone "
- "git-remote-https "
selection_keyword:
CommandLine|contains:
- exploit
- Vulns
- vulnerability
- RemoteCodeExecution
- Invoke-
- CVE-
- poc-
- ProofOfConcept
- proxyshell
- log4shell
- eternalblue
- eternal-blue
- MS17-
condition: all of selection_*
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: aef9d1f1-7396-4e92-a927-4567c7a495c1
type: derived