Checkmarx GitHub Repository Breach: Supply Chain Attack Analysis and Hardening Guide

---
title: Suspicious Git Process Execution on Non-Developer Endpoints
id: 8a4b2c1d-9e6f-4a3b-8c7d-1e2f3a4b5c6d
status: experimental
description: Detects execution of git.exe or git binary on systems where it is not typically present or used, indicating potential lateral movement or data staging. Note: Tune exclusions for authorized developer workstations.
references:
  - https://attack.mitre.org/techniques/T1213/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.collection
  - attack.t1213
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\git.exe'
      - '\git.cmd'
    # Example: Filter out known developer paths to reduce noise, or flag execution from temp folders
    Image|notcontains:
      - '\Program Files\Git'
      - '\Users\' # Exclude user profiles if dev workstations are in scope, or invert logic for servers
  filter_server:
    CommandLine|contains: 'clone'
falsepositives:
  - Legitimate software updates or deployments
  - Developer activities on authorized workstations
level: high
---
title: PowerShell Accessing GitHub API
id: 9b5c3d2e-0f7a-5b4c-9d8e-2f3a4b5c6d7e
status: experimental
description: Detects PowerShell scripts interacting with the GitHub API, which may indicate automated exfiltration or enumeration attempts.
references:
  - https://attack.mitre.org/techniques/T1059/001/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
    CommandLine|contains:
      - 'api.github.com'
      - 'Invoke-RestMethod'
      - 'Invoke-WebRequest'
  condition: selection
falsepositives:
  - Legitimate DevOps automation scripts
  - Package management tools
level: medium


**KQL (Microsoft Sentinel / Defender)**

// Hunt for Git executable usage and network connections
DeviceProcessEvents
| where FileName in~ ("git.exe", "git") 
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName
| join kind=inner (
    DeviceNetworkEvents 
    | where RemoteUrl contains "github.com" 
    | project Timestamp, DeviceName, RemoteUrl, RemotePort, LocalIP
) on DeviceName, Timestamp
| where Timestamp > ago(7d)
| summarize count() by DeviceName, AccountName, RemoteUrl
| where count_ > 10 // Threshold for suspicious volume


**Velociraptor VQL**

-- Hunt for Git processes and .git config access
SELECT Pid, Name, CommandLine, Exe, Username
FROM pslist()
WHERE Name =~ 'git'

-- Hunt for .git directories in unexpected locations (e.g., root or temp)
SELECT FullPath, Size, Mtime
FROM glob(globs="/*/.git/config")
WHERE NOT FullPath =~ "^/home/|^/Users/"  // Exclude standard user home directories


**Remediation Script (PowerShell)**

# Audit Script: Check for recent Git process executions
# Run as Administrator to access all event logs if possible, otherwise relies on PS history/Running procs

Write-Host "[+] Checking for currently running Git processes..."
$gitProcesses = Get-Process -Name git -ErrorAction SilentlyContinue
if ($gitProcesses) {
    Write-Host "[!] ALERT: Found running Git processes:" -ForegroundColor Red
    $gitProcesses | Format-List Id, ProcessName, Path, StartTime
} else {
    Write-Host "[-] No running Git processes found." -ForegroundColor Green
}

Write-Host "[+] Checking PowerShell Event Log for GitHub API interactions (Last 24h)..."
try {
    $events = Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-PowerShell/Operational'; ID=4104; StartTime=(Get-Date).AddHours(-24)} -ErrorAction Stop
    $suspicious = $events | Where-Object { $_.Message -match 'api.github.com' -or $_.Message -match 'git' }
    if ($suspicious) {
        Write-Host "[!] ALERT: Found suspicious PowerShell script blocks:" -ForegroundColor Red
        $suspicious | Select-Object TimeCreated, Id, Message | Format-List
    } else {
        Write-Host "[-] No suspicious PowerShell blocks found." -ForegroundColor Green
    }
} catch {
    Write-Host "[-] Could not read PowerShell Operational Log. Ensure logging is enabled."
}