The demonstrated command uses curl and an existing OAuth bearer token to read items from a named SharePoint list through the SharePoint REST API; the response is printed locally. This is SharePoint data collection. The record has no supported command that uploads collected data to SharePoint or establishes Host-16.Lab.Local as an exfiltration host.
RESTRICTED_ACCESS_BLUR_MARKER