PowerShell Multipart HTTP Data Exfiltration

nomit vyas@xoxo

•updated Jun 25, 2026•5•0•12

Identifies PowerShell execution using 'Invoke-RestMethod' or 'Invoke-WebRequest' to perform HTTP POST operations containing 'multipart/form-data'. This pattern is frequently used to exfiltrate staged data or archives from a compromised host to an external web server.