CL-STA-1062 AD Enumeration Followed by curl POST Exfiltration

Ibrahim Saud@tektrix

•updated Jun 27, 2026•0•0•6

Detects post-compromise activity where an adversary enumerates Domain Admins group memberships using standard Windows utilities (net, net1, nltest, or PowerShell) immediately followed by the use of curl to exfiltrate data via HTTP POST requests to suspicious external infrastructure.