Suspicious Git Clone - Linux

Title: Suspicious Git Clone - Linux
Status: test
Description:Detects execution of "git" in order to clone a remote repository that contain suspicious keywords which might be suspicious
References:
  -https://gist.githubusercontent.com/MichaelKoczwara/12faba9c061c12b5814b711166de8c2f/raw/e2068486692897b620c25fde1ea258c8218fe3d3/history.txt
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-01-03
modified:2023-01-05
Tags:

• -'attack.reconnaissance'
• -'attack.t1593.003'

Logsource:

• category: process_creation
• product: linux

Detection:
  selection_img:
    Image|endswith: '/git'
    CommandLine|contains: ' clone '
  selection_keyword:
    CommandLine|contains:
      -'exploit'
      -'Vulns'
      -'vulnerability'
      -'RCE'
      -'RemoteCodeExecution'
      -'Invoke-'
      -'CVE-'
      -'poc-'
      -'ProofOfConcept'
      -'proxyshell'
      -'log4shell'
      -'eternalblue'
      -'eternal-blue'
      -'MS17-'

  condition:all of selection_*
Falsepositives:
  -Unknown
Level: medium