Skip to content
Threat Feed
Subscribe
medium advisory

Potential Unauthorized Secret Scanning via Gitleaks

Threat actors may leverage the legitimate open-source tool 'Gitleaks' to perform unauthorized secret scanning on compromised hosts to identify and exfiltrate sensitive credentials from source code repositories.

Gitleaks is a legitimate open-source utility designed for security professionals and developers to detect high-entropy strings, API keys, and passwords within code repositories. However, threat actors have increasingly repurposed this tool to support post-compromise activities. By dropping a portable Gitleaks binary onto a compromised host, attackers can perform recursive scans against local workspaces or cloned internal repositories to harvest credentials.

The scope of this threat involves the identification of secrets that are subsequently exfiltrated, enabling lateral movement and service impersonation. Defenders should monitor for Gitleaks execution from atypical, user-writable directories (e.g., /tmp, %TEMP%, or user profiles) and look for command-line arguments that direct output to files (JSON/SARIF) or staging locations for exfiltration. This behavior is often associated with unauthorized access to internal codebases and sensitive development environments.

Impact

Successful exploitation allows attackers to gain unauthorized access to cloud API keys, SSH keys, service tokens, and developer credentials. The potential damage includes widespread service impersonation, unauthorized access to downstream systems, and the exfiltration of proprietary source code. If deployed across a large CI/CD environment or a developer's workstation, the impact can extend to entire production infrastructures.

Recommendation

  • Implement monitoring for the execution of 'gitleaks' or 'gitleaks.exe' using the provided detection rules to identify potentially unauthorized scans.
  • Establish an allowlist or application control policy to restrict the execution of binaries in user-writable directories like %TEMP% and /tmp.
  • Conduct proactive hunting for 'gitleaks.json', '.sarif', or '.csv' files generated in unexpected directories, as these often serve as staging files for exfiltrated credentials.
  • Enforce legitimate secret scanning via approved CI/CD pipelines to reduce the necessity for, and therefore the visibility of, ad-hoc manual scans.
  • Immediately rotate any credentials identified in exfiltrated reports and review git history for committed secrets.

Immediate actions

Deploy the Sigma rule to monitor for Gitleaks binary execution in unauthorized directories.

Detection Engineering 24h

Threat Hunt

Search for files with extensions .json, .sarif, or .csv modified in directories where Gitleaks was executed.

T1552.001 medium medium confidence hunt now

Data: File creation logs

Mitigations

Enforce execution blocklists for known portable binaries in non-standard directories via EDR.

short_term IT Operations

Unauthorized tool usage

Detection coverage 1

Potential Secret Scanning via Gitleaks

medium

Detects the execution of the Gitleaks binary, which may indicate unauthorized credential harvesting from code repositories.

sigma tactics: credential_access techniques: T1213.003, T1552.001 sources: process_creation

Detection queries are available on the platform. Get full rules →