Shell Execution via Git - Linux

SigmaHQ Detections@sigmaHQ

•updated Jul 1, 2025•2•0•22

Detects the use of the "git" utility to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments. The rule specifically looks for 'git' as the parent process, combined with command-line arguments '-p' and 'help', and a child process command line containing 'bash 0<&1', 'dash 0<&1', or 'sh 0<&1'. This pattern is indicative of exploiting git's interactive help functionality to spawn a shell.