Suspicious Executable and Script Downloads from Code Hosting Platforms
Detects the download of potentially suspicious executables, scripts, or archives originating from code hosting platforms like GitHub, GitLab, and various mirrors where files have low prevalence and lack valid signatures.
Microsoft Sentinel (KQL)
