Malicious Script Upload to Code Repository

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•9

This rule detects attempts to upload potentially malicious script or executable files to GitHub's API. It specifically looks for HTTP POST requests to 'api.github.com' with a URI containing '/contents/' and file data matching common executable or script file extensions such as '.exe', '.dll', '.ps1', '.vbs', '.bat', or '.hta'. This activity could indicate an attacker attempting to stage malicious code in a code repository.