FakeGit Campaign Uses 7,600 GitHub Repositories

chiki briki@ekkor13

•updated Jul 22, 2026•6•0•11

This rule detects the execution of known malicious files associated with the FakeGit campaign by matching their SHA256 hashes. Additionally, it identifies suspicious process execution patterns involving 'luau.exe', specifically when it is launched as a standalone process or when initiated by command-line scripts such as .cmd or .bat files.