PowerShell Script With File Upload Capabilities

SigmaHQ Detections@sigmaHQ

•updated Jul 28, 2025•0•16

Detects PowerShell scripts leveraging the "Invoke-WebRequest" or "Invoke-RestMethod" cmdlets to send data using either the "PUT" or "POST" HTTP method. This behavior can indicate an attempt to exfiltrate data from the system.