Void Dokkaebi temp_auto_push.bat commit tampering used for repo-based malware distribution

Emiliano Mema@Nosalva

•updated Jul 16, 2026•1•0•4

This rule monitors for suspicious Git command-line activity that may indicate an attempt to rewrite commit history or force push changes while bypassing verification checks. It detects specific patterns including the execution of 'temp_auto_push.bat', force amending of commits with '--no-verify', and forced pushing with '--no-verify'. These actions are commonly associated with code tampering or the rapid deployment of unauthorized changes to a repository.