MITRE ATT&CK technique · Reconnaissance

`T1593.003` Code Repositories

Sub-technique of T1593 Search Open Websites/Domains

Adversaries may search public code repositories for information about victims that can be used during targeting. Victims may store code in repositories on various third-party websites such as GitHub, GitLab, SourceForge, and BitBucket. Users typically interact with code repositories through a web application or command-line utilities such as git. Adversaries may search various public code…

MITRE ATT&CK page ↗

Who uses it · with stories on Jábega

ShinyHunters
Shai-Hulud

Sigma rules to hunt it

Suspicious Git Clonemediumtest · windows
Suspicious Git Clone - Linuxmediumtest · linux

Rules from SigmaHQ · Detection Rule License 1.1. Technique from MITRE ATT&CK®.