Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8 detections
Filters
Last updated
All Time
Detection languages
5
3
Contributors
4
3
1
Categories
6
5
5
1
1
Platforms
8
5
1
Products / Services
5
5
2
1
1
MITRE Techniques
6
1
1
1
1
CVEs
71
71
64
58
49
IDS Classtypes
5
IDS Protocols
5
Detects incoming HTTP POST requests to the 'diffpatch' endpoint in Gitea that contain suspicious 'diff --git' patterns combined with path traversal sequences ('../') targeting 'hooks/' directories. This indicates an attempt to exploit CVE-2026-60004 to achieve unauthorized file system access or remote code execution via repository hooks.
Detects HTTP POST requests to a Gitea repository's diffpatch API endpoint whose body contains both a real git diff header and the malicious 'hooks/post-index-change' file path used by the CVE-2026-60004 exploit chain to plant an executable Git hook via an add/add merge collision.
Detects HTTP POST requests to a Gitea repository's diffpatch API endpoint whose body contains both a real git diff header and the malicious 'hooks/post-index-change' file path used by the CVE-2026-60004 exploit chain to plant an executable Git hook via an add/add merge collision.
Detects HTTP POST requests to a Gitea repository's diffpatch API endpoint whose body contains both a real git diff header and the malicious 'hooks/post-index-change' file path used by the CVE-2026-60004 exploit chain to plant an executable Git hook via an add/add merge collision.
Detects HTTP POST requests to a Gitea repository's diffpatch API endpoint whose body contains both a real git diff header and the malicious 'hooks/post-index-change' file path used by the CVE-2026-60004 exploit chain to plant an executable Git hook via an add/add merge collision.
Detects unauthorized file system access to sensitive Gitea configuration files (app.ini) or internal directories (custom/conf, data/tmp) by the gitea/git service account. This pattern is indicative of post-exploitation credential or secret harvesting following remote code execution vulnerabilities, such as the diffpatch git hook RCE (CVE-2026-60004).
Detects anomalous shell processes spawned as children of Git operations ('git apply' with index flags or specific plumbing commands) typical of the Gitea repository RCE vulnerability (CVE-2026-60004). This rule identifies malicious Git hooks triggered by the Gitea service account to execute arbitrary commands.
This rule detects the creation of executable files within Git hooks directories ('.git/hooks') initiated by 'git' or 'gitea' processes. The logic specifically excludes files ending in '.sample' to focus on active hook deployment. This behavior is indicative of the 'diffpatch' collision technique (CVE-2026-60004), where attackers attempt to plant malicious Git hooks to achieve remote code execution (RCE) in the context of the Gitea service account.