Detection of PowerShell Downloads from Code Hosting Services

Threat actors frequently abuse legitimate code hosting services like GitHub, GitLab, and Codeberg to stage and retrieve malicious payloads. By hosting payloads as "raw" content, attackers can use native Windows PowerShell cmdlets to download and execute scripts or binaries directly into memory or to disk, bypassing traditional perimeter defenses that might block unknown web domains. This activity is often associated with initial access or delivery stages of malware campaigns, including the Braodo Stealer. Detection engineers must distinguish between legitimate administrative tasks or developer workflows and unauthorized staging of executable content by correlating the PowerShell script block with the process ancestry, the destination path, and the file type retrieved.

Impact

Successful exploitation of this technique allows attackers to stage and execute malicious payloads within an environment. If unauthorized scripts (such as .ps1, .bat) or binaries (.exe, .dll) are retrieved and executed, it can lead to credential theft, persistence establishment, or full system compromise. The severity of the impact depends on the nature of the staged payload and the permissions of the account executing the script.

Recommendation

Prioritize the identification of unauthorized downloads from code hosting services by monitoring PowerShell Script Block Logging.

• Enable PowerShell Script Block Logging (Event ID 4104) and ensure the ScriptBlockText field is ingested into the SIEM.
• Deploy the provided Sigma rule to detect common PowerShell download patterns directed at GitHub, GitLab, or Codeberg raw content URLs.
• Review administrative and developer workstation baseline activity to reduce noise from legitimate script and package management workflows.