Dark Web Supply Chain Risks: Detecting Stolen GitHub Access and API Keys

---
title: Potential GitHub Credential Access via Git Process
id: 89b3c120-7d45-4a3e-8e1f-9a2b3c4d5e6f
status: experimental
description: Detects git processes attempting to read local credential storage files, often a precursor to credential dumping or exfiltration by malicious tools.
references:
  - https://attack.mitre.org/techniques/T1552/
author: Security Arsenal
date: 2026/05/12
tags:
  - attack.credential_access
  - attack.t1552.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\\git.exe'
      - '\\git-credential-manager.exe'
    CommandLine|contains:
      - '.git-credentials'
      - 'config'
  condition: selection
falsepositives:
  - Legitimate developer operations or git configuration updates
level: low
---
title: Suspicious Remote URL Modification in Git
id: a1f2c3d4-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects commands to change a git remote URL, which can indicate an attacker redirecting push operations to a malicious repository after stealing access.
references:
  - https://attack.mitre.org/techniques/T1195/
author: Security Arsenal
date: 2026/05/12
tags:
  - attack.initial_access
  - attack.t1195.002
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\\git.exe'
    CommandLine|contains: 'remote set-url'
  filter:
    CommandLine|contains:
      - 'github.com'
      - 'gitlab.com'
      - 'bitbucket.org'
  condition: selection and not filter
falsepositives:
  - Developers changing remotes for valid migrations or forks
level: medium
---
title: PowerShell GitHub API Interaction with Non-Standard UserAgent
id: b2c3d4e5-6f7a-8b9c-0d1e-2f3a4b5c6d7e
status: experimental
description: Detects PowerShell scripts interacting with the GitHub API. Attackers use this to enumerate repos or exfiltrate code using stolen tokens.
references:
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/05/12
tags:
  - attack.execution
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\\powershell.exe'
    CommandLine|contains:
      - 'api.github.com'
      - 'Invoke-RestMethod'
      - 'Invoke-WebRequest'
  condition: selection
falsepositives:
  - Legitimate DevOps scripts or GitHub CLI tools wrapping PowerShell
level: medium

// Hunt for anomalous Git push operations
let TimeFrame = 1d;
let Baseline = 30d;
let GitProcesses = DeviceProcessEvents
| where Timestamp > ago(Baseline)
| where FileName in~ (\"git.exe\", \"git\")
| where ProcessCommandLine has \"push\"
| summarize dcount(DeviceId) by AccountName, AccountDomain;
DeviceProcessEvents
| where Timestamp > ago(TimeFrame)
| where FileName in~ (\"git.exe\", \"git\")
| where ProcessCommandLine has \"push\"
| join kind=leftanti (
    GitProcesses
) on AccountName, AccountDomain
| project Timestamp, DeviceName, AccountName, AccountDomain, ProcessCommandLine, InitiatingProcessFileName, FolderPath

-- Hunt for potential API Keys in config files
SELECT FullPath, Size, Mtime
FROM glob(globs=\"/*/Users/*/.git/config\", root=\"/\")
WHERE Size < 1000000
-- Further analysis would be required to regex scan contents,
-- this targets the file access artifacts often manipulated during theft.

-- Complementary Hunt for SSH keys
SELECT FullPath, Size, Mtime
FROM glob(globs=\"/*/Users/*/.ssh/id_rsa*\", root=\"/")

# Security Arsenal - Supply Chain Hardening Script
# Check for exposed secrets and verify git configuration

Write-Host \"[+] Initiating Supply Chain Hardening Check...\"

# Define regex patterns for common high-entropy strings (AWS, GitHub, Generic API Keys)
$patterns = @(
    '(?i)AKIA[0-9A-Z]{16}', # AWS Access Key
    '(?i)ghp_[a-zA-Z0-9]{36}', # GitHub PAT
    '(?i)sk-[a-zA-Z0-9]{48}' # Stripe Secret Key (Example of high entropy)
)

# Scan common config locations
$configPaths = @(
    \"$env:USERPROFILE\\.git-credentials\",
    \"$env:USERPROFILE\\.gitconfig\",
    \"$env:APPDATA\
pm\
c\",
    \"$env:USERPROFILE\\.aws\\credentials\"
)

$foundSecrets = $false

foreach ($path in $configPaths) {
    if (Test-Path $path) {
        Write-Host \"[!] Scanning file: $path\"
        $content = Get-Content $path -Raw -ErrorAction SilentlyContinue
        if ($content) {
            foreach ($pattern in $patterns) {
                if ($content -match $pattern) {
                    Write-Host \"[CRITICAL] Potential secret found matching pattern: $pattern in $path\" -ForegroundColor Red
                    $foundSecrets = $true
                }
            }
        }
    }
}

if (-not $foundSecrets) {
    Write-Host \"[+] No obvious hardcoded secrets detected in local config files.\" -ForegroundColor Green
}

# Ensure Credential Helper is not storing secrets indefinitely (Example check)
Write-Host \"[+] Checking Git Credential Helper configuration...\"
$gitConfig = git config --global credential.helper 2>$null
if ($gitConfig) {
    Write-Host \"[INFO] Current credential helper: $gitConfig\"
    Write-Host \"[WARN] Ensure your credential helper integrates with OS keychain (e.g. manager-core) and does not cache indefinitely.\"
} else {
    Write-Host \"[INFO] No global credential helper set.\"
}

Write-Host \"[+] Hardening check complete.\"