huntrule

Suspicious Child Process Spawned by IIS Worker Process w3wp

PremiumReviewedSigma · High · v1
Category
process_creation
Author
HuntRule
Published
2026-09-18
Updated
2026-09-18
AnalysisDetection

ATT&CK techniques

Initial Access → Persistence

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule detects the IIS worker process w3wp.exe spawning a command interpreter or scripting host, a strong indicator of web exploitation or webshell activity such as the ViewState deserialization abuse that delivered the TOLLBOOTH IIS module. Command shells launched from the web server are rarely legitimate.

Reporting behind it

Related detections9 linkedT1190 — drag to rearrange
Suspicious MOVEit Transfer human2.aspx Web Shell Access (via webserver)
Malicious Web Shell Written to SharePoint LAYOUTS Directory by Worker Process (via file_event)
Malicious Command Shell Spawned by SQL Server via Process Creation (via process_creation)
Possible GoAnywhere MFT Exploitation via Tomcat Spawning Discovery Commands
Suspicious Command Shell Spawned by MSSQL Server Process Indicating Webshell
Malicious MOVEit Transfer Exploitation via X-siLock HTTP Headers (via webserver)
Malicious IIS w3wp Worker Spawning Command Interpreter via SharePoint Web Shell
Suspicious Single-Character Named Executable Launched by Web Server Process (via process_creation)
Malicious MOVEit human2.aspx Web Shell Dropped in wwwroot (via file_event)
Suspicious Child Process Spawned by IIS Worker Process w3wp
Pivot detection · T1190 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.