huntrule

Suspicious Data Exfiltration to webhook.site via PowerShell Invoke-WebRequest (via ps_script)

PremiumReviewedSigma · Medium · v1
Product
windows
Category
ps_script
Author
HuntRule
Published
2026-10-15
Updated
2026-10-15
AnalysisDetection

ATT&CK techniques

Execution

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule detects PowerShell piping command output through Out-String into Invoke-WebRequest targeting webhook.site. Threat actors used this technique to exfiltrate host reconnaissance output to an attacker-controlled request-capture endpoint.

Reporting behind it

Related detections9 linkedT1059.001 — drag to rearrange
Suspicious PowerShell Download and Execute via iwr Piped to iex
Suspicious ScreenConnect Remote Access Client Spawning PowerShell (via process_creation)
Suspicious APT42 SMB Share Discovery via Invoke-HuntSMBShares (via ps_script)
Suspicious Scheduled Task Launching rundll32 DLL via Ransomware
Suspicious Child Process Spawned by Triofox GladinetCloudMonitor
Suspicious PowerShell Loader Spawned by mshta via UNC5142 ClickFix
Suspicious ClickFix Clipboard PowerShell Execution from Run Dialog
Suspicious PEAKLIGHT Memory-Only PowerShell Downloader Flags (via process_creation)
Malicious Active Directory ACL Manipulation via PowerView
Suspicious Data Exfiltration to webhook.site via PowerShell Invoke-WebRequest (via ps_script)
Pivot detection · T1059.001 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.