Windows Process Accessing IronLanguages Repository On GitHub — Detection Rule
The following analytic identifies a process command line referencing the IronLanguages GitHub repository, which hosts .NET implementation of popular scripting engines. Adversaries have downloaded these .NET implementations to avoid getting detected by security controls while executing their payloads. This activity is uncommon in typical enterprise environments outside of software development contexts.