Trellix Source Code Breach: Detection and Mitigation of Repository Compromise

---
title: Potential Source Code Exfiltration via Git
id: 9a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects the execution of git commands often used during exfiltration (clone, push) or interaction with remote repositories.
references:
  - https://attack.mitre.org/techniques/T1560/
author: Security Arsenal
date: 2025/01/23
tags:
  - attack.exfiltration
  - attack.t1560
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\git.exe'
      - '\git.cmd'
    CommandLine|contains:
      - 'git clone'
      - 'git push'
      - 'git archive'
  condition: selection
falsepositives:
  - Legitimate developer activity
level: medium
---
title: Suspicious PowerShell Access to SCM Endpoints
id: b1c2d3e4-f5a6-7b8c-9d0e-1f2a3b4c5d6e
status: experimental
description: Detects PowerShell processes making network connections to known Source Code Management endpoints (e.g., GitHub, GitLab) which may indicate manual exfiltration.
references:
  - https://attack.mitre.org/techniques/T1059/001/
author: Security Arsenal
date: 2025/01/23
tags:
  - attack.execution
  - attack.t1059.001
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
    DestinationHostname|contains:
      - 'github.com'
      - 'gitlab.com'
      - 'bitbucket.org'
      - 'dev.azure.com'
  condition: selection
falsepositives:
  - Developers using git-related PowerShell modules
level: low
---
title: Git Executed on Non-Developer System
id: c2d3e4f5-a6b7-8c9d-0e1f-2a3b4c5d6e7f
status: experimental
description: Detects execution of git.exe on systems where it is not typically installed (e.g., Domain Controllers, File Servers), suggesting lateral movement or data staging.
references:
  - https://attack.mitre.org/tactics/TA0001/
author: Security Arsenal
date: 2025/01/23
tags:
  - attack.initial_access
  - attack.defense_evasion
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\git.exe'
  filter_dev:
    Image|contains:
      - '\Program Files\Git\'
      - '\Users\' # Typical user install path
  filter_server_os:
    Product: 'Windows Server 201*' # Adjust based on environment, strictly flagging servers
  condition: selection and not filter_dev # Simplified for broad visibility, tune filter_server_os per environment
falsepositives:
  - Admins using git for config management (IaC)
level: high

DeviceProcessEvents
| where FileName in~ ("git.exe", "git")
| where ProcessCommandLine has_any ("clone", "push", "archive", "remote add", "ls-remote")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine
| order by Timestamp desc

-- Hunt for git processes and .git directories
SELECT 
  Pid, 
  Name, 
  CommandLine, 
  Username, 
  Ctime as ProcessStartTime
FROM pslist()
WHERE Name =~ "git"

-- Optional: Scan for .git folders in user profiles
SELECT 
  FullPath,
  Size,
  ModTime
FROM glob(globs="/*/.git/config")
WHERE FullPath =~ "Users"

# Audit for unauthorized Git repositories
# This script scans the C: drive for .git directories (excluding standard AppData/ProgramData)

Write-Host "Starting Git Repository Audit..."

$ExcludedPaths = @(
    "C:\Program Files",
    "C:\Windows",
    "C:\ProgramData"
)

$DrivesToScan = @("C:\")

$GitRepos = foreach ($Drive in $DrivesToScan) {
    Get-ChildItem -Path $Drive -Recurse -Directory -Filter ".git" -Force -ErrorAction SilentlyContinue |
    Where-Object { 
        $path = $_.FullName
        -not ($ExcludedPaths | Where-Object { $path.StartsWith($_, "OrdinalIgnoreCase") })
    }
}

if ($GitRepos) {
    Write-Host "[!] Found Git Repositories:" -ForegroundColor Yellow
    $GitRepos | ForEach-Object { 
        Write-Host "Location: $($_.FullName)"
        # Check for recent modifications
        $configFile = Join-Path $_.FullName "config"
        if (Test-Path $configFile) {
            $lastMod = (Get-Item $configFile).LastWriteTime
            Write-Host "Last Modified: $lastMod"
        }
    }
} else {
    Write-Host "No unauthorized Git repositories found."
}