Malicious .git Configs Hijack Claude Code, Codex, Cursor AI Agents — Detection and Hardening Guide

---
title: Git Spawning Shell or Script Interpreter as Child Process
id: 3f8a2c71-9b4d-4e6a-a1c2-5d7e9f0b8a34
status: experimental
description: Detects git.exe spawning shells, script interpreters, or common LOLBins — consistent with command execution via malicious .git/config directives (core.sshCommand, core.fsmonitor, core.pager) abused to hijack AI coding agents.
references:
  - https://thehackernews.com/2026/09/malicious-git-configs-can-make-claude.html
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/09/15
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\git.exe'
      - '\git-remote-https.exe'
      - '\git-remote-ssh.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\certutil.exe'
      - '\curl.exe'
      - '\bash.exe'
      - '\sh.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare; legitimate Git hooks configured by developers may spawn interpreters — baseline per-repo hook usage before tuning
level: high
---
title: Command-Bearing Git Config Key Written via git config
id: 7c1e9d42-2a5f-4b8c-b3d6-8e0a4f1c6b29
status: experimental
description: Detects git config invocations that set executable-naming directives (core.sshCommand, core.fsmonitor, core.pager, gpg.program) — the mechanism used to poison a repository's .git/config and hijack AI coding agents.
references:
  - https://thehackernews.com/2026/09/malicious-git-configs-can-make-claude.html
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/09/15
tags:
  - attack.execution
  - attack.t1059
  - attack.defense_evasion
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith: '\git.exe'
  selection_cmd:
    CommandLine|contains:
      - 'config'
  selection_keys:
    CommandLine|contains:
      - 'core.sshCommand'
      - 'core.sshcommand'
      - 'core.fsmonitor'
      - 'core.pager'
      - 'core.editor'
      - 'gpg.program'
      - 'credential.helper'
  condition: selection_img and selection_cmd and selection_keys
falsepositives:
  - Developers legitimately configuring core.sshCommand for custom SSH or core.pager for diff tools — investigate non-standard paths and newly onboarded repositories
level: medium
---
title: AI Coding Agent Process Spawning Suspicious Descendants
id: 9d4b6f18-3c7e-4a1d-92b5-6f8c0e2a7d51
status: experimental
description: Detects CLI AI coding agents (Claude Code, Codex, Cursor) spawning shell interpreters or download cradles — consistent with out-of-sandbox command execution triggered by malicious repository configuration.
references:
  - https://thehackernews.com/2026/09/malicious-git-configs-can-make-claude.html
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/09/15
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\claude.exe'
      - '\codex.exe'
      - '\cursor-agent.exe'
      - '\cursor.exe'
    ParentCommandLine|contains:
      - 'claude'
      - 'codex'
      - 'cursor-agent'
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\cmd.exe'
      - '\curl.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
      - '\mshta.exe'
  selection_suspicious:
    CommandLine|contains:
      - 'http://'
      - 'https://'
      - '-enc'
      - 'FromBase64String'
      - 'IEX'
      - 'DownloadString'
      - 'Invoke-WebRequest'
  condition: selection_parent and selection_child and selection_suspicious
falsepositives:
  - Agent workflows legitimately fetching remote content — correlate with repository provenance and whether the fetched host is an approved internal or vendor domain
level: high

// Hunt 1: git config setting executable-naming keys + git spawning shells
let DangerousGitKeys = dynamic(["core.sshcommand", "core.fsmonitor", "core.pager", "core.editor", "gpg.program"]);
let ShellChildren = dynamic(["cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "certutil.exe", "curl.exe", "bash", "sh", "python", "python3", "node"]);
let ConfigPoisoning =
    DeviceProcessEvents
    | where TimeGenerated > ago(14d)
    | where FileName =~ "git.exe" or FileName =~ "git"
    | where ProcessCommandLine has "config"
    | where ProcessCommandLine has_any (DangerousGitKeys)
    | project TimeGenerated, DeviceName, AccountName, ProcessCommandLine, FolderPath, InitiatingProcessFileName, InitiatingProcessCommandLine;
let GitSpawningShells =
    DeviceProcessEvents
    | where TimeGenerated > ago(14d)
    | where InitiatingProcessFileName has "git"
    | where FileName has_any (ShellChildren)
    | project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256;
union ConfigPoisoning, GitSpawningShells
| summarize FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), Events = count() by DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName
| order by LastSeen desc
;
// Hunt 2: AI coding agent descendants reaching the network or encoding payloads
let AgentParents = dynamic(["claude", "codex", "cursor", "cursor-agent"]);
DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName has_any (AgentParents) or InitiatingProcessCommandLine has_any (AgentParents)
| where ProcessCommandLine has_any ("FromBase64String", "DownloadString", "Invoke-WebRequest", "IEX", " -enc", "certutil -decode", "curl http", "wget http")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by TimeGenerated desc

-- Hunt for command-bearing directives in repository .git/config files
-- across user profile directories (Windows developer workstations)
LET configs = SELECT FullPath, Mtime
FROM glob(
  globs='C:/Users/*/**/.git/config',
  accessor='ntfs'
)

SELECT FullPath,
       Mtime AS ConfigLastModified,
       read_file(filename=FullPath, length=65536) AS ConfigContent,
       array(
         "core.sshCommand", "core.fsmonitor", "core.pager",
         "core.editor", "gpg.program", "credential.helper"
       ) AS SearchedKeys
FROM configs
WHERE ConfigContent =~ '(?i)(core\.sshcommand|core\.fsmonitor|core\.pager|core\.editor|gpg\.program|credential\.helper)\s*='

#!/usr/bin/env bash
# Security Arsenal - Git config poisoning audit & remediation
# Scans all .git/config files under the given root for command-bearing keys.
set -euo pipefail

SCAN_ROOT="${1:-$HOME}"
REPORT="$HOME/git-config-audit-$(date +%Y%m%d-%H%M%S).txt"
DANGEROUS_KEYS="core.sshCommand|core.fsmonitor|core.pager|core.editor|gpg.program|credential.helper|include.path|includeIf"

echo "[+] Scanning $SCAN_ROOT for .git/config files with command-bearing directives..."
echo "Scan root: $SCAN_ROOT | $(date)" > "$REPORT"

find "$SCAN_ROOT" -type f -path "*/.git/config" 2>/dev/null | while read -r cfg; do
  if grep -Eiq "^\s*(${DANGEROUS_KEYS})\s*=" "$cfg"; then
    echo "[!] SUSPICIOUS: $cfg" | tee -a "$REPORT"
    grep -Ein "^\s*(${DANGEROUS_KEYS})\s*=" "$cfg" | tee -a "$REPORT"
    echo "---" >> "$REPORT"
  fi
done

if grep -q "SUSPICIOUS" "$REPORT"; then
  echo "[!] Findings written to $REPORT — review each key's value before removing."
  echo "    To strip a key from a repo:  git -C /path/to/repo config --unset core.fsmonitor"
else
  echo "[OK] No command-bearing Git config directives found under $SCAN_ROOT"
fi

# Baseline hardening: disable fsmonitor hooks globally unless explicitly needed
echo "[+] Applying global hardening..."
git config --global core.fsmonitor false 2>/dev/null || true
git config --global --unset-all core.sshCommand 2>/dev/null || true

echo "[+] Git version check (upgrade to the latest 2.4x/2.5x release):"
git --version