Contagious Interview - Malicious npm/Go Package Install After git clone on Developer Host
This rule monitors process creation events for 'git' or 'npm' command-line activities that are highly indicative of potential software supply chain attacks. It triggers when known malicious package names or suspicious patterns are detected within command-line arguments, or when a workflow involves a git clone followed by subsequent npm installation, which is a common vector for deploying malicious dependencies.
Splunk (SPL)
