Phantom Taurus Malicious IIServerCore Behavior

Tim Peck@timpeck

•updated Jan 27, 2026•1•1•139

Detects the IIS worker process (w3wp.exe) spawning a command-line interpreter or reconnaissance tool. This is a common behavior of web shells and in-memory backdoors like IIServerCore, which is part of the NET-STAR malware suite used by the Phantom Taurus APT group.