huntrule

Obfuscated IIS Worker Spawning Encoded PowerShell after SharePoint ToolShell (via process_creation)

PremiumReviewedSigma · High · v1
Product
windows
Category
process_creation
Author
HuntRule
Published
2026-09-01
Updated
2026-09-01
AnalysisDetection

ATT&CK techniques

Initial Access → Execution

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule detects the IIS worker process w3wp.exe spawning a command shell or PowerShell with a Base64-encoded command, the post-exploitation behavior observed after SharePoint ToolShell exploitation of CVE-2025-53770. Adversaries run encoded PowerShell from the web server context to install webshells and stage further tooling.

Reporting behind it

Related detections9 linkedT1059.001 — drag to rearrange
Malicious ActiveMQ Exploitation Java Spawning PowerShell Downloader (via process_creation)
Suspicious Cleo Autorun Health Check File Drop (via file_event)
Malicious WSUS Service Spawning Command Shell via Remote Code Execution
Malicious PowerShell Spawned by IIS Worker Process via OWASSRF Exchange Exploitation (via process_creation)
Suspicious Child Process Spawned From Java Following Web Exploitation
Suspicious IIS Worker Process Spawning Encoded PowerShell via Gladinet Exploitation
MSSQL Server Process Spawning Command Shell via xp_cmdshell
Suspicious IIS Worker Process Spawning Encoded PowerShell via CentreStack Exploitation
Malicious FortiClient Process Spawning PowerShell Downloader (via process_creation)
Obfuscated IIS Worker Spawning Encoded PowerShell after SharePoint ToolShell (via process_creation)
Pivot detection · T1059.001 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.