PowerShell Download from Code Hosting Service — Detection Rule
This analytic detects PowerShell Script Block Logging (Event ID 4104) events that use common download methods to retrieve files directly from raw-content URLs on GitHub, GitLab, or Codeberg. These code hosting services can be abused to stage payloads, but administrators and developers also download files from them. A match identifies a download attempt; it does not establish that the file was successfully retrieved or executed. Review the full script block, destination path, process ancestry, and related endpoint activity.