title: PowerShell HTTP Form Submission
description: Detection of powershell data POST and PUT with Invoke-WebRequest.
author: keyboardcrunch
date: 10/10/2020
modified: 
mitre:
   tactic: Exfiltration
   technique: T1020
   subtechnique: 
operating_system: windows
query: SrcProcCmdLine ContainsCIS "Invoke-WebRequest" AND (SrcProcCmdLine ContainsCIS
  "-Method Put" OR SrcProcCmdLine ContainsCIS "-Method Post")
false_positives: 
   - PowerShell HTTP form submissions.
tags: