Elastic medium stable eql

Potential Secret Scanning via Gitleaks

This rule detects the execution of Gitleaks, a tool used to search for high-entropy strings and secrets in code repositories, which may indicate an attempt to access credentials.

View Source

Detection Logic

process where event.type == "start" and event.action like ("exec", "exec_event", "start", "ProcessRollup2", "executed", "process_started", "Process Create*") and
process.name : ("gitleaks.exe", "gitleaks")

False Positives

  • ⚠ Gitleaks is a legitimate open-source tool used by security professionals and developers to search for sensitive information, such as passwords, API keys, and other secrets, within code repositories. It is commonly employed during security assessments and code reviews to identify potential vulnerabilities.

Field Validations

Loading…

Comments (0)

Loading comments...