Suspicious cmd.exe Spawned by w3wp.exe with CentreStack portal.config Parent Command Line (Windows)

Alerts when w3wp.exe launches cmd.exe and its command line references \portal\portal.config, suggesting possible IIS app exploitation.

FreeUnreviewedSigmahighv1

suspicious-cmd-exe-spawned-by-w3wp-exe-with-centrestack-portal-config-parent-com-2d79e371

title: Suspicious cmd.exe Spawned by w3wp.exe with CentreStack portal.config Parent Command Line (Windows)
id: 723b85fa-c5ad-4144-b8dc-6e2f8e85cddd
status: experimental
description: This rule flags process creation where cmd.exe is spawned by w3wp.exe, specifically when the w3wp.exe command line includes \portal\portal.config. This pattern is significant because it indicates unexpected command shell execution from an IIS worker process, which can be consistent with web application exploitation leading to code execution. It relies on Windows process creation telemetry capturing parent image/command line and the spawned process image.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2025-30406
  - https://blackpointcyber.com/blog/racing-to-exploit-centrestacks-cve-2025-30406/
  - https://gladinetsupport.s3.us-east-1.amazonaws.com/gladinet/securityadvisory-cve-2005.pdf
  - https://www.bleepingcomputer.com/news/security/centrestack-rce-exploited-as-zero-day-to-breach-file-sharing-servers/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2025/Exploits/CVE-2025-30406/proc_creation_win_exploit_cve_2025_30406_centrestack_portal_child_process.yml
author: Jason Rathbun (Blackpoint Cyber), Huntrule Team
date: 2025-04-17
tags:
  - attack.persistence
  - attack.execution
  - attack.t1059.003
  - attack.t1505.003
  - cve.2025-30406
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \w3wp.exe
    ParentCommandLine|contains: \portal\portal.config
    Image|endswith: \cmd.exe
  condition: selection
falsepositives:
  - Potentially if other portal services run on w3wp with a apppool\portal\portal.config, if you want to increase scope you could add user IIS APPPOOL\portal.
level: high
license: DRL-1.1
related:
  - id: 2d79e371-2a27-42de-87a4-b4213fc72a6a
    type: derived

What it detects

This rule flags process creation where cmd.exe is spawned by w3wp.exe, specifically when the w3wp.exe command line includes \portal\portal.config. This pattern is significant because it indicates unexpected command shell execution from an IIS worker process, which can be consistent with web application exploitation leading to code execution. It relies on Windows process creation telemetry capturing parent image/command line and the spawned process image.

Known false positives

Potentially if other portal services run on w3wp with a apppool\portal\portal.config, if you want to increase scope you could add user IIS APPPOOL\portal.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.