Detects potential GitHub-based data exfiltration by identifying a high volume of repository ZIP downloads (repo.download_zip) initiated by a single non-bot user from a single source IP within a short time window. The rule targets the scenario where an actor leverages HTTP ZIP downloads to retrieve full repository archives, which can bypass git clone-based monitoring and token-scoped access controls. Detection aggregates events by user.name and github.actor_ip within a 10-minute window and triggers when the count of archive downloads (event_count) reaches or exceeds 8, while excluding automated actors (github.actor_is_bot: false) and events lacking an actor IP. The query also captures contextual metadata such as downloaded repositories, organizations, token usage (Esql.github_token_id_values), programmatic access type, and user agent to aid investigations and correlate with other access patterns. This helps distinguish bulk data collection from legitimate development or backup activities. The rule is mapped to MITRE ATT&CK techniques related to Exfiltration (T1020 Automated Exfiltration; T1567 Exfiltration Over Web Service with a subtechnique for Exfiltration to Code Repository) and Collection (T1213 Data from Information Repositories; T1213.003 Code Repositories). The investigation fields provide actionable data for triage, including actor identity, IP, token context, and the specific repositories involved. Overall, the rule aims to surface suspicious mass repository downloads that could indicate credential abuse, stolen tokens, or targeted data collection attempts, enabling rapid containment and remediation.