Data Exfiltration - PowerShell Multipart HTTP POST

Ibrahim Saud@tektrix

•updated Jun 23, 2026•1•0•7

Identifies PowerShell using Invoke-RestMethod or Invoke-WebRequest to exfiltrate archives via HTTP POST, specifically looking for multipart/form-data boundaries in the command line.