Data Exfiltration via GitHub Gists and Private Code Repositories

let CorpGitOrg = "<YOUR_GITHUB_ORG>"; // e.g. "df00tech" - replace with your registered org/group name
let CodeRepoApiDomains = dynamic(["api.github.com", "api.gitlab.com", "api.bitbucket.org"]);
// Signal 1: git push to a remote that does not reference the corporate org/group
let NonCorpGitPush = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName =~ "git.exe" or FileName =~ "git"
| where ProcessCommandLine has "push"
| where ProcessCommandLine has_any ("github.com", "gitlab.com", "bitbucket.org")
| where not(ProcessCommandLine has CorpGitOrg)
| extend Signal = "GitPushNonCorpRemote"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, Signal;
// Signal 2: anonymous Gist / paste creation via scripting engines calling the Gist API
let AnonGistCreate = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName has_any ("curl", "curl.exe", "powershell.exe", "pwsh.exe", "python", "python.exe")
| where ProcessCommandLine has "api.github.com/gists"
| where ProcessCommandLine has_any ("-X POST", "-X PUT", "Invoke-RestMethod", "Invoke-WebRequest", "requests.post", "method='POST'")
| extend Signal = "AnonGistCreate"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, Signal;
// Signal 3: direct Contents API PUT (file upload without git client) from a non-CI/CD host
let ContentsApiUpload = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName has_any ("curl", "curl.exe", "powershell.exe", "pwsh.exe", "python", "python.exe")
| where ProcessCommandLine has_any (CodeRepoApiDomains)
| where ProcessCommandLine has_any ("/contents/", "/repos/") and ProcessCommandLine has_any ("-X PUT", "-X POST", "requests.put", "requests.post")
| where DeviceName !endswith "-runner" and DeviceName !endswith "-agent" // exclude known CI/CD runner naming convention
| extend Signal = "ContentsApiUpload"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, Signal;
union NonCorpGitPush, AnonGistCreate, ContentsApiUpload
| sort by Timestamp desc

index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
(
  (Image="*\\git.exe" AND CommandLine="*push*" AND (CommandLine="*github.com*" OR CommandLine="*gitlab.com*" OR CommandLine="*bitbucket.org*") AND NOT CommandLine="*<YOUR_GITHUB_ORG>*")
  OR ((Image="*\\curl.exe" OR Image="*\\powershell.exe" OR Image="*\\pwsh.exe" OR Image="*\\python.exe")
      AND CommandLine="*api.github.com/gists*"
      AND (CommandLine="*POST*" OR CommandLine="*PUT*" OR CommandLine="*Invoke-RestMethod*" OR CommandLine="*Invoke-WebRequest*"))
  OR ((Image="*\\curl.exe" OR Image="*\\powershell.exe" OR Image="*\\pwsh.exe" OR Image="*\\python.exe")
      AND (CommandLine="*api.github.com*" OR CommandLine="*api.gitlab.com*" OR CommandLine="*api.bitbucket.org*")
      AND (CommandLine="*/contents/*" OR CommandLine="*/repos/*")
      AND (CommandLine="*PUT*" OR CommandLine="*POST*"))
)
| eval Signal=case(
    match(CommandLine, "(?i)push"), "GitPushNonCorpRemote",
    match(CommandLine, "(?i)gists"), "AnonGistCreate",
    true(), "ContentsApiUpload"
  )
| stats count AS Events, values(CommandLine) AS Commands BY host, User, Image, Signal
| sort - Events

process where event.type == "start" and
(
  (process.name : "git" and process.command_line : "*push*" and
   process.command_line : ("*github.com*", "*gitlab.com*", "*bitbucket.org*") and
   not process.command_line : "*<YOUR_GITHUB_ORG>*")
  or (
    process.name : ("curl", "powershell.exe", "pwsh.exe", "python.exe", "python") and
    process.command_line : "*api.github.com/gists*" and
    process.command_line : ("*POST*", "*PUT*", "*Invoke-RestMethod*", "*Invoke-WebRequest*")
  )
  or (
    process.name : ("curl", "powershell.exe", "pwsh.exe", "python.exe", "python") and
    process.command_line : ("*api.github.com*", "*api.gitlab.com*", "*api.bitbucket.org*") and
    process.command_line : ("*/contents/*", "*/repos/*") and
    process.command_line : ("*PUT*", "*POST*")
  )
)

SELECT
    DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS EventTime,
    hostname AS Hostname,
    username AS User,
    "Process Name" AS ProcessName,
    "Command Line" AS CommandLine,
    LOGSOURCETYPENAME(logsourceid) AS LogSourceType,
    CASE
        WHEN LOWER("Command Line") LIKE '%push%' AND (LOWER("Command Line") LIKE '%github.com%' OR LOWER("Command Line") LIKE '%gitlab.com%' OR LOWER("Command Line") LIKE '%bitbucket.org%') THEN 'GitPushNonCorpRemote'
        WHEN LOWER("Command Line") LIKE '%api.github.com/gists%' THEN 'AnonGistCreate'
        WHEN (LOWER("Command Line") LIKE '%/contents/%' OR LOWER("Command Line") LIKE '%/repos/%') THEN 'ContentsApiUpload'
        ELSE 'Unclassified'
    END AS Signal
FROM events
WHERE LOGSOURCETYPENAME(logsourceid) IN ('Microsoft Windows Security Event Log', 'Sysmon')
  AND (
    (LOWER("Process Name") LIKE '%git.exe%' AND LOWER("Command Line") LIKE '%push%')
    OR (
        (LOWER("Process Name") LIKE '%curl.exe%' OR LOWER("Process Name") LIKE '%powershell.exe%' OR LOWER("Process Name") LIKE '%python.exe%')
        AND (LOWER("Command Line") LIKE '%api.github.com%' OR LOWER("Command Line") LIKE '%api.gitlab.com%' OR LOWER("Command Line") LIKE '%api.bitbucket.org%')
    )
  )
  AND starttime > NOW() - 86400000
ORDER BY starttime DESC
LIMIT 500

(_sourceCategory="windows/sysmon" OR _sourceCategory="endpoint/windows/sysmon") EventCode=1
| where (Image matches "*git.exe" AND CommandLine matches "*push*" AND (CommandLine matches "*github.com*" OR CommandLine matches "*gitlab.com*" OR CommandLine matches "*bitbucket.org*"))
    OR (
        (Image matches "*curl.exe" OR Image matches "*powershell.exe" OR Image matches "*python.exe")
        AND CommandLine matches "*api.github.com/gists*"
        AND (CommandLine matches "*POST*" OR CommandLine matches "*PUT*")
    )
    OR (
        (Image matches "*curl.exe" OR Image matches "*powershell.exe" OR Image matches "*python.exe")
        AND (CommandLine matches "*api.github.com*" OR CommandLine matches "*api.gitlab.com*" OR CommandLine matches "*api.bitbucket.org*")
        AND (CommandLine matches "*/contents/*" OR CommandLine matches "*/repos/*")
    )
| eval Signal = if(CommandLine matches "*push*", "GitPushNonCorpRemote",
    if(CommandLine matches "*gists*", "AnonGistCreate", "ContentsApiUpload"))
| stats count AS Events, values(CommandLine) AS CommandLines BY ComputerName, User, Image, Signal
| sort BY Events desc

rule code_repository_data_exfiltration {
  meta:
    author = "df00tech"
    description = "Detects data exfiltration via git push to non-corporate remotes and Gist/Contents API abuse"
    severity = "MEDIUM"
    mitre_attack_tactic = "Exfiltration"
    mitre_attack_technique = "T1567.001"
    threat_actors = "Turla, APT41, Lazarus Group"
    reference = "https://attack.mitre.org/techniques/T1567/001/"

  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    (
      (re.regex($e.target.process.file.full_path, `(?i)git(\.exe)?$`)
       and re.regex($e.target.process.command_line, `(?i)push`)
       and re.regex($e.target.process.command_line, `(?i)(github\.com|gitlab\.com|bitbucket\.org)`))
      or (
        re.regex($e.target.process.file.full_path, `(?i)(curl|powershell|pwsh|python)(\.exe)?$`)
        and re.regex($e.target.process.command_line, `(?i)api\.github\.com/gists`)
      )
      or (
        re.regex($e.target.process.file.full_path, `(?i)(curl|powershell|pwsh|python)(\.exe)?$`)
        and re.regex($e.target.process.command_line, `(?i)(api\.github\.com|api\.gitlab\.com|api\.bitbucket\.org)`)
        and re.regex($e.target.process.command_line, `(?i)(/contents/|/repos/)`)
      )
    )
    $hostname = $e.principal.hostname

  condition:
    $e
}

#event_simpleName=ProcessRollup2
| ImageFileName=/(?i)git(\.exe)?$/ AND CommandLine=/(?i)push/ AND CommandLine=/(?i)(github\.com|gitlab\.com|bitbucket\.org)/
  OR (ImageFileName=/(?i)(curl|powershell|pwsh|python)(\.exe)?$/ AND CommandLine=/(?i)api\.github\.com\/gists/)
  OR (ImageFileName=/(?i)(curl|powershell|pwsh|python)(\.exe)?$/
      AND CommandLine=/(?i)(api\.github\.com|api\.gitlab\.com|api\.bitbucket\.org)/
      AND CommandLine=/(?i)(\/contents\/|\/repos\/)/)
| Signal := case {
    CommandLine=/(?i)push/ => "GitPushNonCorpRemote";
    CommandLine=/(?i)gists/ => "AnonGistCreate";
    * => "ContentsApiUpload"
  }
| groupBy(
    [ComputerName, UserName, ImageFileName, Signal],
    function=[count(as=EventCount), collect(CommandLine, limit=10)]
  )
| sort(field=EventCount, order=desc)