An interesting malware event landed in our SIEM. It was caught when it tried to load a .NET module. Right from the start, something told me that this was malicious but also interesting enough to warrant further investigation. A quick foreword: the GitHub account serving this was reported. At the time of writing, only the impromptu file has been taken down; the rest of the account continues to host malicious-looking scripts.