Raw Payload Download from Code Repository

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•3

This rule detects attempts to download raw payload files (PowerShell scripts, executables, DLLs, batch files, VBScripts, Python scripts, or shell scripts) from raw.githubusercontent.com. This activity is often associated with adversaries attempting to retrieve malicious tools or scripts from code repositories.