Detect Code Repositories in CrowdStrike LogScale

#event_simpleName=ProcessRollup2
// Classify secret scanning tool usage
| IsSecretScan := FileName = /trufflehog|gitleaks|git.secrets|gitrob|shhgit|detect.secrets|git.hound|gitallsecrets/i
    OR CommandLine = /trufflehog|gitleaks|git.secrets|gitrob|shhgit|detect.secrets|git.hound|gitallsecrets/i
// Classify repository API enumeration by scripting engines
| IsAPIEnum := CommandLine = /api\.github\.com\/(orgs|users|repos|search)|gitlab\.com\/api\/v4\/(projects|groups)|api\.bitbucket\.org\/2\.0\/repositories|dev\.azure\.com/i
    AND FileName = /python3?(\.exe)?$|powershell(\.exe)?$|pwsh(\.exe)?$|curl(\.exe)?$|wget(\.exe)?$/i
// Classify git bulk extraction
| IsBulkExtract := FileName = /\bgit(\.exe)?$/i
    AND CommandLine = /\b(archive|bundle)\b/i
// Classify git clone
| IsBulkClone := FileName = /\bgit(\.exe)?$/i
    AND CommandLine = /\bclone\b/i
// Keep only relevant events
| IsSecretScan = true OR IsAPIEnum = true OR IsBulkExtract = true OR IsBulkClone = true
// Aggregate per host, user, and process within 1-hour buckets
| groupBy(
    [ComputerName, UserName, FileName, IsSecretScan, IsAPIEnum, IsBulkExtract, IsBulkClone],
    function=[
        count(as=EventCount),
        collect(CommandLine, limit=15, as=CommandSamples),
        min(@timestamp, as=FirstSeen),
        max(@timestamp, as=LastSeen)
    ])
// Apply threshold: bulk clone requires 5+ events, all others fire immediately
| IsSecretScan = true
    OR IsAPIEnum = true
    OR IsBulkExtract = true
    OR (IsBulkClone = true AND EventCount >= 5)
// Label detection type
| DetectionType := case {
    IsSecretScan = true => "SecretScanningToolExecution";
    IsAPIEnum = true => "RepositoryAPIEnumeration";
    IsBulkExtract = true => "GitBulkExtraction";
    IsBulkClone = true AND EventCount >= 5 => "BulkRepositoryCloning";
    * => "MultipleSignals"
  }
| table([FirstSeen, LastSeen, ComputerName, UserName, FileName, DetectionType, EventCount, CommandSamples])
| sort(FirstSeen, order=desc)