CL-STA-1062 PowerShell Recon and HTTP POST Exfil to C2 IPs

Ibrahim Saud@tektrix

•updated Jun 27, 2026•1•0•5

Detects suspicious PowerShell processes executing common system reconnaissance commands (e.g., whoami, net group, ipconfig) combined with network communication indicators, specifically HTTP method or body flags, or connections to known suspicious IP addresses.