CL-STA-1062 PowerShell Recon and HTTP POST Exfiltration to 202.182.102.5

Ibrahim Saud@tektrix

•updated Jun 26, 2026•0•0•6

Detects the execution of PowerShell commands commonly used for host reconnaissance (e.g., whoami, ipconfig, net group, systeminfo) combined with the use of PowerShell to perform an HTTP POST request to a suspicious external IP address (202.182.102.5), suggesting post-compromise reconnaissance data exfiltration.