Git Branch Created With Name Matching 40-Char SHA-1 Hash (Plugin4Shell)

Ibrahim Saud@tektrix

•updated 21 days ago•0•0•3

Detects the creation of a Git branch where the branch name matches the pattern of a 40-character hexadecimal SHA-1 hash. This behavior is associated with the 'Plugin4Shell' technique, which exploits how some git implementations prioritize matching ref names over target commit objects, enabling an attacker to manipulate or swap code in automated systems or AI coding agents that rely on SHA-pinning.