720a3356-eee1-4015-9135-0fc08f7eb2d5.yml

- id: 720a3356-eee1-4015-9135-0fc08f7eb2d5
  name: Find Git Repositories
  description: This ability will locate directories that are cloned Git repositories.
  tactic: collection
  technique:
    attack_id: T1005
    name: Data from Local System
  platforms:
    linux:
      sh:
        command: |
          for directoryname in $(find /home/ -name '.git' -type d 2>/dev/null | head -5); do
          	printf "$(dirname "$directoryname")\n";
          done;
        parsers:
          plugins.stockpile.app.parsers.basic:
            - source: host.dir.git
    windows:
      psh,pwsh:
        command: |
          Get-ChildItem C:\Users -Attributes Directory+Hidden -ErrorAction SilentlyContinue -Filter ".git" -Recurse | foreach {$_.parent.FullName} | Select-Object; exit 0;
        parsers:
          plugins.stockpile.app.parsers.basic:
            - source: host.dir.git