Windows Process Creation: Suspicious Git Clone Command With Vulnerability Keywords

title: "Windows Process Creation: Suspicious Git Clone Command With Vulnerability Keywords"
id: 10b555df-1b1c-473d-b8be-91a1d885d9bc
status: test
description: This rule flags Windows process creation events where git is executed (including git.exe or git-remote-https.exe) and the command line includes a git clone action. It further requires the command line to contain one or more vulnerability- or exploit-related keywords (for example, exploit, CVE-, ProofOfConcept, and common named CVEs). This matters because attackers may use cloning of remote repositories to stage or distribute exploit tooling. The detection relies on process creation telemetry capturing the Image/OriginalFileName and the full CommandLine.
references:
  - https://gist.githubusercontent.com/MichaelKoczwara/12faba9c061c12b5814b711166de8c2f/raw/e2068486692897b620c25fde1ea258c8218fe3d3/history.txt
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_git_susp_clone.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-01-03
modified: 2023-01-10
tags:
  - attack.reconnaissance
  - attack.t1593.003
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith:
        - \git.exe
        - \git-remote-https.exe
    - OriginalFileName: git.exe
  selection_cli:
    CommandLine|contains:
      - " clone "
      - "git-remote-https "
  selection_keyword:
    CommandLine|contains:
      - exploit
      - Vulns
      - vulnerability
      - RemoteCodeExecution
      - Invoke-
      - CVE-
      - poc-
      - ProofOfConcept
      - proxyshell
      - log4shell
      - eternalblue
      - eternal-blue
      - MS17-
  condition: all of selection_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: aef9d1f1-7396-4e92-a927-4567c7a495c1
    type: derived