{"id":"T1593.003","name":"Code Repositories","url":"https://attack.mitre.org/techniques/T1593/003","tactics":["reconnaissance"],"platforms":["PRE"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0805","stix_id":"x-mitre-detection-strategy--9f2af07f-ef27-4737-b262-a8862faebffa","name":"Detection of Code Repositories","url":"https://attack.mitre.org/detectionstrategies/DET0805","analytics":[{"id":"AN1937","stix_id":"x-mitre-analytic--3b25198c-e31d-4e0c-9d26-eb8e714c71a8","name":"Analytic 1937","description":"Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders. \n\nDetection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.","url":"https://attack.mitre.org/detectionstrategies/DET0805#AN1937","platforms":["PRE"],"log_source_references":[],"mutable_elements":[],"live":true,"detection_strategies":["DET0805"],"techniques":["T1593.003"]}],"live":true,"version":"1.0","techniques":["T1593.003"]}],"sigma_rules":[{"id":"aef9d1f1-7396-4e92-a927-4567c7a495c1","title":"Suspicious Git Clone","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2023-01-03","modified":"2023-01-10","description":"Detects execution of \"git\" in order to clone a remote repository that contain suspicious keywords which might be suspicious","references":["https://gist.githubusercontent.com/MichaelKoczwara/12faba9c061c12b5814b711166de8c2f/raw/e2068486692897b620c25fde1ea258c8218fe3d3/history.txt"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.reconnaissance","attack.t1593.003"],"path":"rules/windows/process_creation/proc_creation_win_git_susp_clone.yml","techniques":["T1593.003"],"cves":[]},{"id":"cfec9d29-64ec-4a0f-9ffe-0fdb856d5446","title":"Suspicious Git Clone - Linux","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2023-01-03","modified":"2023-01-05","description":"Detects execution of \"git\" in order to clone a remote repository that contain suspicious keywords which might be suspicious","references":["https://gist.githubusercontent.com/MichaelKoczwara/12faba9c061c12b5814b711166de8c2f/raw/e2068486692897b620c25fde1ea258c8218fe3d3/history.txt"],"logsource":{"product":"linux","category":"process_creation"},"tags":["attack.reconnaissance","attack.t1593.003"],"path":"rules/linux/process_creation/proc_creation_lnx_susp_git_clone.yml","techniques":["T1593.003"],"cves":[]}],"kev_cves":[],"_built":"2026-08-23 05:47 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}