Repeated Git Clone/Fetch Activity

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•3

Detects repeated 'git clone' or 'git fetch' commands executed on a system within a short timeframe. This activity could indicate an adversary attempting to exfiltrate data from a code repository or staging environment, or rapidly pull down multiple repositories.