Github Request for PNG File With PowerShell User-Agent

Tim Peck@timpeck

•updated Nov 11, 2025•0•18

This rule detects HTTP GET requests to github.com for PNG files where the User-Agent header contains "WindowsPowerShell". This combination could indicate an attempt to download malicious content or C2 instructions disguised as an image file using PowerShell.