huntrule

Malicious Shell Spawned by SharePoint Worker Process w3wp

PremiumReviewedSigma · High · v1
Product
windows
Category
process_creation
Author
HuntRule
Published
2026-09-14
Updated
2026-09-14
AnalysisDetection

ATT&CK techniques

Execution → Persistence

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule detects the SharePoint worker process w3wp.exe spawning a command shell or PowerShell, the post-exploitation behavior following ToolShell webshell deployment. A web server worker launching interactive shells indicates webshell execution or exploitation of the hosting application.

Reporting behind it

Related detections9 linkedT1505.003 — drag to rearrange
Malicious IIS w3wp Worker Spawning Command Interpreter via SharePoint Web Shell
Exchange Worker Process Spawning Command Shell via OWASSRF
Malicious Command Execution Spawned by SharePoint w3wp Worker Process
Malicious IIS Worker Process Spawning Command Shell via process_creation
Suspicious cmd.exe execution from w3wp.exe tied to CentreStack portal.config (Windows process creation)
Suspicious Weaver Ant In-Memory Web Shell Marker in Web Request (via webserver)
Malicious Web Server Process Spawning Command Interpreter via Web Shell (via process_creation)
Malicious Web Shell Written to SharePoint LAYOUTS Directory by Worker Process (via file_event)
Suspicious Doenerium Host Fingerprinting via cmd.exe
Malicious Shell Spawned by SharePoint Worker Process w3wp
Pivot detection · T1505.003 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.