Malware Builder Download from Code Repository

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•6

This rule detects attempts to download malware builder tools (such as builders, generators, crypters, or packers) from raw.githubusercontent.com. It specifically looks for HTTP traffic where the host is 'raw.githubusercontent.com' and the URI contains keywords commonly associated with malware development tools.