Suspicious Git Clone

Title: Suspicious Git Clone
Status: test
Description:Detects execution of "git" in order to clone a remote repository that contain suspicious keywords which might be suspicious
References:
  -https://gist.githubusercontent.com/MichaelKoczwara/12faba9c061c12b5814b711166de8c2f/raw/e2068486692897b620c25fde1ea258c8218fe3d3/history.txt
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-01-03
modified:2023-01-10
Tags:

• -'attack.reconnaissance'
• -'attack.t1593.003'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_img:
    - Image|endswith:
      - '\git.exe'
      - '\git-remote-https.exe'
OriginalFileName:'git.exe'   selection_cli:
    CommandLine|contains:
      -' clone '
      -'git-remote-https '

  selection_keyword:
    CommandLine|contains:
      -'exploit'
      -'Vulns'
      -'vulnerability'
      -'RemoteCodeExecution'
      -'Invoke-'
      -'CVE-'
      -'poc-'
      -'ProofOfConcept'
      -'proxyshell'
      -'log4shell'
      -'eternalblue'
      -'eternal-blue'
      -'MS17-'

  condition:all of selection_*
Falsepositives:
  -Unknown
Level: medium