Script-Based Data Upload via PowerShell - WSH
When binaries are blocked or the operator is living off the land, uploads are done with .NET primitives and cmdlets (WebClient.UploadFile, Invoke-RestMethod -Method Post -InFile, FtpWebRequest). The logic is anchored on strong upload indicators (not just webclient + a URL, which mostly catches download cradles).
Microsoft Sentinel (KQL)
