Iptables can only tell you that a connection occurred. To determine which process or command was involved, it's best to use ss + eBPF (auditd).

To determine the data sent, use tcpdump/ngrep or strace.