This analytic targets PowerShell Script Block Logging (Event ID 4104) and flags cases where ScriptBlockText contains download techniques that pull files from raw-content URLs on common code-hosting services (GitHub, GitLab, Codeberg). It detects a download attempt using typical PowerShell and download tools, including DownloadFile/DownloadData/DownloadString, Invoke-WebRequest/Invoke-RestMethod, Start-BitsTransfer, as well as curl and wget, with URL patterns pointing to raw content on code-hosting platforms. The rule does not guarantee successful retrieval or execution of the file; it highlights potential staging of payloads and prompts review of the full ScriptBlockText, destination path, process ancestry, and related endpoint activity. The detection aggregates results by destination, signature, and process context and surfaces first/last seen times for investigation. It maps to MITRE ATT&CK techniques T1059.001 (PowerShell) and T1105 (Ingress Tool Transfer). It is intended for endpoint telemetry ingested from PowerShell Script Block Logging and leverages a Splunk macro for time formatting. The rule is production-grade, with a true-positive test referencing a sample Powershell download scenario. Known false positives include legitimate software deployment or admin downloads from code-hosting services, requiring review of repository ownership, the downloaded file, destination path, signer (if applicable), and subsequent execution before acting on any alert. References include related security blogs and Windows PowerShell logging guidance, and the detection supports drill-downs to view per-destination results and associated risk context.