Git credential cache access followed by anomalous remote push

Ibrahim Saud@tektrix

•updated Sep 21, 2026•0•0•4

This rule detects potential credential theft by correlating access to local git credential files (e.g., .git-credentials, .netrc) followed by a git push event from the same user account within 24 hours. The rule flags these pushes if they originate from an unrecognized host or an IP address outside of the trusted internal network range.