<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: detecting-malicious-code-commits
description: >-
  Detect malicious code commits including backdoors, obfuscated payloads,
  credential harvesting, and unauthorized modifications to security-critical
  code paths. Analyze commit patterns for insider threat indicators.
domain: cybersecurity
subdomain: supply-chain-security
tags:
  - malicious-commits
  - code-review
  - backdoor-detection
  - insider-threat
  - git-forensics
  - code-integrity
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1195.002"]
---

# Detecting Malicious Code Commits

## Overview

Malicious code commits can introduce backdoors, exfiltrate secrets, or weaken
security controls through seemingly benign changes. This skill covers detection
of suspicious commit patterns, obfuscated code injection, unauthorized changes
to security-critical files, and behavioral analysis of contributor activity
to identify potential insider threats or compromised accounts.

Mode: `[MODE: BLUE]` — Detect malicious code commits through pattern analysis and git forensics.

## Prerequisites

| Requirement | Details |
|---|---|
| git with full history access | Required |
| semgrep for static analysis (`pip install semgrep`) | Required |
| trufflehog for secret scanning (`brew install trufflehog`) | Required |
| jq for JSON processing | Required |
| Python 3.10+ with `gitpython` | Required |

## Key Concepts

### Suspicious Commit Pattern Detection

```bash
# Find commits modifying security-critical files
git log --all --oneline -- '*.pem' '*.key' '*.env' 'auth*' 'crypto*' 'security*'

# Detect large binary additions (potential payload drops)
git log --all --diff-filter=A --name-only --format='%H %an %s' -- '*.so' '*.dll' '*.exe' '*.bin'

# Find commits with obfuscated content
git log -p --all -S 'eval(' --format='%H %an %ae %s' | head -100
git log -p --all -S 'base64' --format='%H %an %ae %s' | head -100

# Detect unusual commit times (off-hours activity)
git log --format='%H %ai %an' | awk '{split($2,d,"-"); split($3,t,":"); if (t[1]+0 < 6 || t[1]+0 > 22) print}'
```

### Backdoor Pattern Scanning

```bash
# Scan for common backdoor patterns with semgrep
semgrep --config "p/security-audit" --json .

# Detect reverse shell patterns
grep -rn 'socket.*connect\|subprocess.*shell=True\|os.system\|exec(' --include='*.py' .
grep -rn 'child_process\|net.Socket\|eval(' --include='*.js' .

# Find hidden eval/exec patterns
grep -rn 'getattr.*__import__\|compile.*exec\|\\x[0-9a-f]' --include='*.py' .
```

### Commit Author Anomaly Detection

```bash
# Identify first-time contributors modifying critical files
git log --format='%an|%ae' | sort | uniq -c | sort -rn | tail -20

# Detect email address changes for known contributors
git log --format='%an|%ae' | sort -u | awk -F'|' '{a[$1]++; if(a[$1]>1) print}'

# Find force pushes (history rewriting)
git reflog | grep 'forced-update'
```

## Workflow

### Step 1: Scan repository for malicious commit patterns

```bash
node scripts/agent.js --action scan --repo /tmp/target --output /tmp/scan-result.json
```

### Step 2: Analyze specific commit for malicious indicators

```bash
node scripts/agent.js --action analyze --repo /tmp/target --output /tmp/analyze-result.json
```

### Step 3: Generate malicious commit detection report

```bash
node scripts/agent.js --action report --repo /tmp/target --output /tmp/report-result.json
```

## Detection

```yaml
title: Malicious Code Commits Detection
id: 5d95fca8-4a0a-443b-927e-0e762eb6a640
status: experimental
description: Detects suspicious activity related to detecting malicious code commits techniques in supply chain security context
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    CommandLine: "*detecting*malicious*"
  condition: selection
level: medium
tags:
  - attack.t1195.002
  - attack.initial_access
falsepositives:
  - Package manager performing routine dependency resolution
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Malicious Code Commits Detection | linux/process_creation | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1195.002 |

## Verification

- [ ] No obfuscated or encoded payloads detected in recent commits
- [ ] Security-critical file changes reviewed and approved
- [ ] No unauthorized modifications to authentication or crypto code
- [ ] Commit author identities verified against known contributor list
- [ ] No secrets or credentials present in commit history

## References

- [Semgrep Rules Registry](https://semgrep.dev/explore)
- [TruffleHog Documentation](https://github.com/trufflesecurity/trufflehog)
- [Git Forensics Techniques](https://git-scm.com/book/en/v2/Git-Internals-Git-Objects)
- [MITRE ATT&CK T1195.002](https://attack.mitre.org/techniques/T1195/002/)
