PolinRider-style cached git credential harvesting

Ibrahim Saud@tektrix

•updated Sep 21, 2026•0•0•3

This rule detects unauthorized access, creation, or modification of Git credential files (.git-credentials, .netrc) by processes other than standard Git credential management utilities. It also monitors command-line activity that references these credential stores to identify potential attempts to exfiltrate or manipulate stored credentials.