Data Exfiltrated via GitHub Repository Push

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•4

This rule detects potential data exfiltration attempts via a GitHub repository push. It specifically looks for HTTP POST requests to 'github.com' with the URI '/git-receive-pack' and a data size greater than 10000 bytes. This pattern is indicative of a 'git push' operation, which could be used to upload sensitive data to a public or controlled GitHub repository.