# Custom rule: catch execution of any git hook file gitea didn't put there.
# Added after the 2026-08-10/11 gitea internal-API log-poisoning attack, where
# an attacker used /api/internal/manager/add-logger to write a malicious
# uploadpack.packObjectsHook entry into the global .gitconfig, pointed at a
# planted hooks/pre-applypatch.sample file under an unrelated repo. Gitea only
# ever manages four hook names per repo (post-receive, pre-receive, update,
# proc-receive), each delegating to a same-named script under hooks/*.d/gitea -
# anything else executing from a hooks/ path is not something Gitea put there.
#
# BUG FOUND 2026-08-16: the original condition checked proc.name against
# gitea_managed_hook_names, but git's hook dispatcher always execs these as
# `bash ./hooks/<hookname>.d/gitea` - proc.name is "bash" (the interpreter),
# never "pre-receive"/"gitea"/etc. That check could never match, so this
# rule fired CRITICAL on every single git push to gitea - confirmed via
# docker logs falco showing 3 alerts (pre-receive/update/post-receive) on
# every push, including this repo's own commits. Fixed to check the actual
# invoked script path in proc.cmdline instead of proc.name.

- rule: Unexpected git hook execution
  desc: >
    A process executed from a path under a git repository's hooks/ directory
    whose script isn't one of Gitea's own managed hook scripts. Catches
    planted hooks used for persistence/RCE (e.g. a malicious
    uploadpack.packObjectsHook or receive hook), independent of how the
    file got written.
  condition: >
    spawned_process
    and container.name = "gitea"
    and proc.cmdline contains "/hooks/"
    and not (proc.cmdline glob "*hooks/pre-receive.d/gitea"
          or proc.cmdline glob "*hooks/update.d/gitea *"
          or proc.cmdline glob "*hooks/post-receive.d/gitea"
          or proc.cmdline glob "*hooks/proc-receive.d/gitea"
          or proc.cmdline glob "*hooks/proc-receive.d/gitea *")
  output: >
    Unexpected git hook executed
    (user=%user.name command=%proc.cmdline exepath=%proc.exepath
    parent=%proc.pname container=%container.name pid=%proc.pid)
  priority: CRITICAL
  tags: [git, persistence, mitre_persistence]