Potential Data Exfiltration Activity Via CommandLine Tools

SigmaHQ Detections@sigmaHQ

•updated Oct 29, 2025•2•0•40

Detects the use of various command-line utilities like PowerShell, curl, and wget to exfiltrate data via web requests, specifically looking for POST requests containing common system information or sensitive data commands.