Suspicious Git Clone with Exploit Keywords - Linux

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•34

This rule detects the execution of the 'git clone' command on Linux systems when the command line arguments contain suspicious keywords. These keywords are indicative of activities related to exploits, vulnerabilities, remote code execution (RCE), or proof-of-concept (PoC) code for known vulnerabilities like ProxyShell, Log4Shell, and EternalBlue. The rule aims to identify attempts by adversaries to download malicious or exploit-related code from remote repositories.