Git Clone Repository (PowerShell)

Group by: _time, host
Source: github.com/anvilogic-forge/armory

Git is a free and open source distributed version control system designed to handle everything from small to very large projects with speed and efficiency. Recent vulnerabilities identified would allow adversaries remote code execution after cloning a repo. GIT-LFS CVE-2020-27955

MITRE ATT&CK coverage

Tactic	Techniques
Command & Control	`T1105` Ingress Tool Transfer

References

https://exploitbox.io/vuln/Git-Git-LFS-RCE-Exploit-CVE-2020-27955.html

Telemetry coverage

Provider	Record / event type
PowerShell	Event ID 4104: Creating Scriptblock text (MessageNumber of MessageTotal).

Rule body

id: '6100.6572'
title: Git Clone Repository
description: Git is a free and open source distributed version control system designed
  to handle everything from small to very large projects with speed and efficiency.
  Recent vulnerabilities identified would allow adversaries remote code execution
  after cloning a repo. GIT-LFS CVE-2020-27955
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4104) OR
  TERM(<EventID>4104<)) (TERM(git) OR TERM(GH)) TERM(clone) | table _time, host, user,
  signature_id, process, process_* | bin span=1s | stats values(*) as * by _time,
  host '
techniques:
- command-and-control:ingress tool transfer
technique_id: 
- T1105
data_category:
- PowerShell logs
- Process command-line parameters
references:
- https://exploitbox.io/vuln/Git-Git-LFS-RCE-Exploit-CVE-2020-27955.html

Stages and Predicates

Stage 1: `search`

`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4104) OR TERM(<EventID>4104<)) (TERM(git) OR TERM(GH)) TERM(clone)

Stage 2: `table`

| table _time, host, user, signature_id, process, process_*

Stage 3: `bucket`

| bin span=1s

Stage 4: `stats`

| stats values(*) as * by _time, host

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`EventCode`	eq	`4104` corpus 269 (splunk 269)	`field:"EventID" kind:eq value:"4104"`

Search terms

These SPL tokens match against raw event text.

Stage	Term
1	`"<EventID>4104<"`
1	`git`
1	`GH`
1	`clone`