PowerShell GitHub API/PAT Usage
Detects PowerShell execution that interacts with GitHub API or raw content endpoints and includes a GitHub Personal Access Token (PAT) in the command line. This combination can indicate malicious activity such as data exfiltration, code deployment, or C2 communication, especially if originating from an unexpected host or user.
CQL
