Git Branch Created with Name Spoofing a Pinned Commit SHA (Plugin4Shell)

Ibrahim Saud@tektrix

•updated 21 days ago•0•0•3

Detects Git command line executions involving 'branch', 'checkout', or 'push' operations that reference what appear to be full commit hashes as branch references. The rule flags instances where 'refname is ambiguous' warnings are generated, which may indicate an attempt to manipulate or interact with git repositories in ways that conflict with existing branches, potentially suggesting malicious repository tampering or discovery activity.