Potential Credential Discovery in Git History Windows

Swachchhanda Shrawan Poudel (Nextron Systems)

Detects attempts to search git commit history for credentials or API keys. Attackers target git history because secrets that were committed and later removed remain recoverable, making repositories a valuable source of credentials even after remediation. Various supply chain attacks have been observed leveraging this technique to steal credentials from CI/CD environments.

2026-10-19 00:00:00

None

d7f3c05e-8a1b-4e92-d26f-0b4e8c3a1f75

attack.credential-access attack.t1552.001

Nextron Sigma feed only (private)