CL-STA-1062 PowerShell Recon HTTP POST Exfiltration to 202.182.102.5
Detects the execution of reconnaissance commands (whoami, ipconfig, net group) via PowerShell that also include either specific internal IP address patterns or curl-based exfiltration patterns, suggesting potential adversary activity.
Splunk (SPL)
