CL-STA-1062 PowerShell Recon Exfiltration via curl POST to 202.182.102.5

Ibrahim Saud@tektrix

•updated Jun 27, 2026•0•0•3

This rule detects PowerShell activity where commands are used to perform reconnaissance (e.g., whoami, ipconfig, or network group enumeration) and the output is exfiltrated or sent via a POST request to a specific external IP address (202.182.102.5).