Git Submodule Cloned - Windows (Sysmon)

Group by: _time, host
Source: github.com/anvilogic-forge/armory

Adversaries may abuse a bug in Git whereby it can be fooled into writing files not into the submodule's worktree but into a .git/ directory. This allows writing a hook that will be executed while the clone operation is still running, giving the user no opportunity to inspect the code that is being executed. This use case detects when a submodule from a GitHub repository was cloned onto the system Vulnerability Association: CVE-2024-32002

MITRE ATT&CK coverage

Tactic	Techniques
Command & Control	`T1105` Ingress Tool Transfer

References

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule body

id: '32307.57462'
title: Git Submodule Cloned - Windows
description: 'Adversaries may abuse a bug in Git whereby it can be fooled into writing
  files not into the submodule''s worktree but into a `.git/` directory. This allows
  writing a hook that will be executed while the clone operation is still running,
  giving the user no opportunity to inspect the code that is being executed. This
  use case detects when a submodule from a GitHub repository was cloned onto the system
  Vulnerability Association: CVE-2024-32002'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  (TERM(git) OR TERM(gh)) TERM(submodule) TERM(clone) | table _time, host, user, process,
  process_path, signature_id, parent_process_path | bin span=1s | stats values(*)
  as * by _time, host '
techniques:
- command-and-control:ingress tool transfer
technique_id: 
- T1105
data_category:
- Windows Sysmon
references:
- https://github.com/amalmurali47/git_rce/tree/main
- https://nvd.nist.gov/vuln/detail/CVE-2024-32002
- https://amalmurali.me/posts/git-rce/

Stages and Predicates

Stage 1: `search`

`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<") (TERM(git) OR TERM(gh)) TERM(submodule) TERM(clone)

Stage 2: `table`

| table _time, host, user, process, process_path, signature_id, parent_process_path

Stage 3: `bucket`

| bin span=1s

Stage 4: `stats`

| stats values(*) as * by _time, host

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`EventCode`	eq	`1` corpus 241 (splunk 225, kusto 15, elastic 1)	`field:"EventID" kind:eq value:"1"`

Search terms

These SPL tokens match against raw event text.

Stage	Term
1	`"<EventID>1<"`
1	`git`
1	`gh`
1	`submodule`
1	`clone`