Data Exfiltrated to GitLab Repository

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•4

This rule detects potential data exfiltration to a GitLab repository. It specifically looks for HTTP POST requests to gitlab.com with the URI containing '/git-receive-pack' and a data size greater than 10KB. This pattern is indicative of a 'git push' operation, which could be used to exfiltrate data.