Payload Download from GitLab Raw

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•3

This rule detects attempts to download executable or script files (PowerShell, executable, DLL, shell script, Python script) from the 'raw' content section of gitlab.com. This behavior is often associated with adversaries staging or retrieving malicious payloads.