Stitch-SDK - Global Git Config Extraction (T1082)

Ibrahim Saud@tektrix

•updated Jun 20, 2026•0•0•1

Detects the execution of global Git credential collection commands spawned from Node during package installations. This rule specifically looks for 'node.exe' as the initiating process, executing 'git' with the arguments 'config', '--global', and 'user.email'. This behavior is indicative of an attempt to extract global Git configuration, potentially for credential harvesting.