huntrule

Malicious IIS Worker Process Spawning Command Shell Reconnaissance

PremiumReviewedSigma · High · v1
Product
windows
Category
process_creation
Author
HuntRule
Published
2026-09-11
Updated
2026-09-11
AnalysisDetection

ATT&CK techniques

Initial Access → Persistence

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule detects the IIS worker process w3wp.exe spawning cmd.exe or powershell.exe to run host reconnaissance such as ipconfig, tasklist or dir. UAT-6382 exploited a Cityworks zero-day to drop web shells and then executed this recon under the web server context, a hallmark of post-exploitation web-shell activity that precedes tooling download and Cobalt Strike deployment.

Reporting behind it

Related detections9 linkedT1190 — drag to rearrange
Malicious Command Shell Spawned by SQL Server via Process Creation (via process_creation)
Possible GoAnywhere MFT Exploitation via Tomcat Spawning Discovery Commands
Suspicious Command Shell Spawned by MSSQL Server Process Indicating Webshell
Malicious MOVEit Transfer Exploitation via X-siLock HTTP Headers (via webserver)
Malicious IIS w3wp Worker Spawning Command Interpreter via SharePoint Web Shell
Suspicious Single-Character Named Executable Launched by Web Server Process (via process_creation)
Malicious MOVEit human2.aspx Web Shell Dropped in wwwroot (via file_event)
Malicious IIS Worker Process Spawning PowerShell via Gladinet CentreStack Exploit
Exchange Worker Process Spawning Command Shell via OWASSRF
Malicious IIS Worker Process Spawning Command Shell Reconnaissance
Pivot detection · T1190 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.