Suspicious Command Shell Execution by CentreStack Portal AppPool

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•24

Detects unexpected command shell execution (cmd.exe) from w3wp.exe when tied to CentreStack's portal.config, indicating potential exploitation (e.g., CVE-2025-30406). This behavior is highly indicative of a web shell or similar remote code execution vulnerability being exploited on the CentreStack portal.