Git Branch Created With SHA-Formatted Name (SHA-Pinning Bypass)

Ibrahim Saud@tektrix

•updated Sep 18, 2026•6•0•5

This rule detects the creation or pushing of a local Git branch where the branch name matches the pattern of a 40-character SHA-1 or 64-character SHA-256 hash. This behavior is indicative of the Plugin4Shell exploitation technique, where attackers create branches named after specific commit SHAs to bypass security checks on self-hosted Git services like Bitbucket by pinning them to unintended commits.