🪝 Canary Git Hook

Git hooks beaconing on unauthorized clone.

→ Explore in ATT&CK matrix (2 mappings) Deployment detail

What it is

A Git pre-commit or post-checkout hook (.git/hooks/) that beacons when the repository is cloned and hooks are executed on a non-corporate machine. Detects source code theft and unauthorized development environments.

Implementation requirements

Custom Git hook script in .githooks/ (shared via core.hooksPath configuration)
Hook checks: Is the machine on the corporate network? Is the user in the allowed developer list?
If checks fail: Silent HTTP beacon to DOAR endpoint with hostname, username, IP, repo name
OPSEC: Hook must perform its beacon silently without breaking the developer workflow
Limitation: Git hooks are not automatically copied on git clone (unless using template directories or core.hooksPath). Consider using Husky (npm) or pre-commit (Python) frameworks which DO get installed automatically.
Rollback: Remove the hook from repositories and from any hook templates.
Upkeep: Git does not copy hooks when a repository is cloned, so confirm how your setup distributes them and test on a fresh clone.

Technologies

CI/CD

ATT&CK coverage 2

Technique	Tactic	Status	Confidence	Tier
T1213.003 Code Repositories	Collection	confirmed	strong	T2
↳ Detection point: the decoy fires at a later step of the attack
↳ Evidence (4 sources) GitGuardian Honeytoken — core concepts — Production honeytokens placed in code repositories, CI/CD, Docker images, Jira, Confluence and Slack alert when used. CloudKeys in the Air: Tracking Malicious Operations of Exposed IAM Keys — AWS keys planted on GitHub were harvested and used by attackers within minutes. AWS API Keys token — Canarytokens documentation — A fake AWS key alerts on any use through the AWS API. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1213.003 Code Repositories as an adversary behaviour.
T1552.001 Credentials In Files	Credential Access	confirmed	strong	T2
↳ Detection point: the decoy fires at a later step of the attack
↳ Evidence (5 sources) CloudKeys in the Air: Tracking Malicious Operations of Exposed IAM Keys — AWS keys planted on GitHub were harvested and used by attackers within minutes. 2023 Honeypotting in the Cloud Report — AWS keys planted in GitHub, S3, ECR, EBS and other resources were found and used; GitHub keys within 2 minutes. GitGuardian Honeytoken — core concepts — Production honeytokens placed in code repositories, CI/CD, Docker images, Jira, Confluence and Slack alert when used. AWS API Keys token — Canarytokens documentation — A fake AWS key alerts on any use through the AWS API. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1552.001 Credentials In Files as an adversary behaviour.

Evidence

Canarytokens — Thinkst Applied Research industry
MITRE ATT&CK Enterprise v20.0 — MITRE 2026 standard

Research basis: Thinkst Canarytokens (Industry Standard). Extension of repository canary concept.