Git Branch Created with SHA-Shaped Name (Plugin4Shell Spoofing)

Ibrahim Saud@tektrix

•updated Sep 18, 2026•0•0•0

This rule detects Git repository modification events (such as pushes, branch creation, or reference creation) where the reference name matches a hexadecimal string (often indicative of a specific commit hash being pushed as a branch or tag) and the host is not github.com. This may indicate suspicious repository activity or interaction with non-standard or unauthorized code repositories.