CVE-2026-44309 — Gitsign is a keyless Sigstore to signing tool for Git

title: Suspicious Gitsign Usage with Older Versions - CVE-2026-44309
id: scw-2026-05-15-ai-1
status: experimental
level: high
description: |
  Detects the execution of 'gitsign verify' or 'gitsign verify-tag' commands. This is a core indicator for CVE-2026-44309, as these commands are vulnerable in versions prior to 0.16.0 due to improper handling of commit/tag object verification, allowing for signature bypass and the association of a signature with unintended content.
author: SCW Feed Engine (AI-generated)
date: 2026-05-15
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-44309/
tags:
  - attack.command_and_control
  - attack.t1071.004
logsource:
    category: process_creation
detection:
  selection:
      Image|endswith:
          - 'gitsign'
      CommandLine|contains:
          - 'verify'
          - 'verify-tag'
      condition: selection
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse