This anomaly detects Windows processes whose command lines reference the IronLanguages GitHub repository (which hosts .NET implementations of scripting engines such as IronPython). In adversary activity, such downloads are used to obtain tooling to execute payloads, a pattern uncommon outside software development contexts. The rule ingests endpoint telemetry from Sysmon Process creation events, Windows Security event 4688, and CrowdStrike ProcessRollup2, filtering for command lines containing "*/ironlanguages/*" and "*github.com*". It surfaces rich context (process, parent process, original file name, file path, user) to enable triage and containment. The detection supports cross-event correlation and can be used to trigger alerts when a host attempts to fetch external tooling from GitHub, potentially preceding payload delivery or tool transfer. MITRE mappings include T1059 (Command and Scripting Interpreter) and T1105 (Ingress Tool Transfer). False positives occur when developers or DevOps personnel legitimately clone IronLanguages from GitHub; mitigation should include whitelisting known-good hosts/users and corroborating with additional context (e.g., time, user role, project activity). Operational guidance suggests collecting full command lines, validating the source and integrity of fetched tooling, and applying least-privilege containment on affected hosts.