BioShocking: Browser Credential Exfiltration via raw.githubusercontent.com

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•1

This rule detects web browser processes (Chrome, Edge, Brave, Electron) making network requests to 'raw.githubusercontent.com' that contain keywords indicative of sensitive data, such as 'credential', 'secret', 'password', 'token', 'api_key', or '.env'. This behavior may indicate an adversary attempting to download configuration files or sensitive credentials hosted on GitHub.