SharePoint Worker Process Spawning Suspicious Child Process

Ethan Andrews@eandrews

•updated Feb 28, 2026•6•0•79

Detects the Microsoft SharePoint worker process (w3wp.exe) spawning suspicious child processes often used for post-exploitation activity, such as command shells or scripting engines. This behavior is a strong indicator of a webshell execution, as seen in the ToolShell exploitation campaigns.