GitHub Repository Bulk Clone for Data Collection

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•3

This rule detects a high volume of HTTP requests to GitHub's archive endpoint for repository cloning, specifically looking for 10 or more requests within 60 seconds from a single source IP. This behavior could indicate an attempt to collect data from multiple GitHub repositories, potentially for reconnaissance or data exfiltration purposes. The rule targets HTTP traffic where the host is 'github.com' and the URI contains '/archive/'.