Contagious Interview - Malicious Go Package Download via Hijacked Module Paths
Detects the execution of the Go compiler (go.exe) using command-line arguments that reference specific third-party GitHub repositories. This behavior is indicative of potential supply chain compromise, where an attacker might attempt to build or install malicious modules disguised as legitimate dependencies, or the use of automated tools that may be part of an adversary's development workflow.
Splunk (SPL)
