Anvilogic medium experimental spl
Git Hooks Spawn System32 Process [splunk-sysmon]
Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries with the help of Git hooks. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, Windows installations include the Windows Command Shell and PowerShell. This use case detects Git hooks spawning a System32 process. Note: for best rule fidelity, Windows Event or Sysmon process creation logs are recommended due to their detailed parent process path information. Vulnerability reference: CVE-2024-32002
Detection Logic
`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1)
OR "<EventID>1<") TERM(git) (TERM(hook)
OR TERM(hooks)) "C:\\Windows\\System32"
| where match(process, "(?i)C:\x5cWindows\x5csystem32") and match(parent_process_path, "(?i)\x5cgit\x5c") and not match(process, "(?i)\x5c\?\?\x5cC:\x5cWindows\x5csystem32\x5cconhost\.exe\s+0xffffffff\s+-ForceV1")
| table _time, host, user, process_*, process, signature_id, parent_*
| bin span=1s
| stats values(*) as * by _time, hostField Validations
Loading…
Comments (0)
Loading comments...