CL-STA-1062 PowerShell Recon Exfiltration via curl HTTP POST to C2

Ibrahim Saud@tektrix

•updated Jun 27, 2026•0•0•8

Detects the use of PowerShell to perform system reconnaissance commands and exfiltrate the collected data using HTTP POST requests (curl or Invoke-WebRequest). This behavior is often associated with post-compromise activity and is flagged with higher severity when initiated from an IIS worker process or when using encoded PowerShell arguments.