Suspicious Git Clone with Exploit Keywords
This rule detects the execution of 'git.exe' or 'git-remote-https.exe' when attempting to clone a remote repository. The detection is specifically triggered if the command line arguments contain keywords commonly associated with exploits, vulnerabilities, or proof-of-concept code, such as 'exploit', 'Vulns', 'vulnerability', 'RemoteCodeExecution', 'Invoke-', 'CVE-', 'poc-', 'ProofOfConcept', 'proxyshell', 'log4shell', 'eternalblue', 'eternal-blue', or 'MS17-'. This aims to identify reconnaissance activities where adversaries might be searching for or downloading publicly available exploit code.
Sigma
