Exploit Framework Module Download

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•6

This rule detects the download of files from raw.githubusercontent.com that contain keywords commonly associated with exploit frameworks, CVEs, or Proof-of-Concepts (PoCs). It specifically looks for 'exploit', 'cve-[0-9]{4}', or 'poc' within the HTTP URI. This activity could indicate an attacker downloading tools or modules for exploitation during resource development or initial access phases.