Potential Data Exfiltration Activity Via CommandLine Tools

Action1: actionname = "Process started" AND ((PROCESSNAME endswith "\powershell_ise.exe,\powershell.exe,\pwsh.exe,\cmd.exe" AND COMMANDLINE contains "curl ,Invoke-RestMethod,Invoke-WebRequest,irm ,iwr ,wget " AND (COMMANDLINE contains " -ur" AND COMMANDLINE contains " -me" AND COMMANDLINE contains " -b" AND COMMANDLINE contains " POST ")) OR ((PROCESSNAME endswith "\curl.exe" AND COMMANDLINE contains "--ur") AND COMMANDLINE contains " -d , --data ") OR (PROCESSNAME endswith "\wget.exe" AND COMMANDLINE contains "--post-data,--post-file")) AND (COMMANDLINE contains "Get-Content,GetBytes,hostname,ifconfig,ipconfig,net view,netstat,nltest,qprocess,sc query,systeminfo,tasklist,ToBase64String,whoami" OR (COMMANDLINE contains "type " AND COMMANDLINE contains " > " AND COMMANDLINE contains " C:")) select Action1.HOSTNAME,Action1.MESSAGE,Action1.COMMANDLINE,Action1.FILE_NAME,Action1.PROCESSNAME,Action1.USERNAME,Action1.PARENTPROCESSNAME