Executable File Written to Git Hooks Directory via diffpatch Collision

Ethan Andrews@eandrews

•updated Jul 29, 2026•3•0•7

This rule detects the creation of executable files within Git hooks directories ('.git/hooks') initiated by 'git' or 'gitea' processes. The logic specifically excludes files ending in '.sample' to focus on active hook deployment. This behavior is indicative of the 'diffpatch' collision technique (CVE-2026-60004), where attackers attempt to plant malicious Git hooks to achieve remote code execution (RCE) in the context of the Gitea service account.