Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1 detection
Filters
Last updated
All Time
Detection languages
1
Contributors
1
Categories
1
1
1
Platforms
1
1
MITRE Techniques
1
1
1
1
CVEs
71
71
64
58
49
Detects `git rebase` commands containing the `--exec=` flag when spawned by a Gogs or Gitea server process. This activity is indicative of the exploitation of an argument injection vulnerability (CVE-2022-46153) in Gogs/Gitea, which allows an authenticated user to achieve Remote Code Execution (RCE) by creating a pull request with a specially crafted branch name. The rule specifically looks for `git` or `git.exe` processes executing `rebase` with `--exec=` and originating from `gogs`, `gitea`, or common shell processes that might be spawned by them.
