Webshell Default Recon Command Execution (IIS w3wp.exe)
Detects an IIS worker process (w3wp.exe) spawning cmd.exe with a specific chain of reconnaissance commands (whoami, hostname, ipconfig). This behavior matches the default execution pattern of the 'hc2.aspx' and 'health_check_t.aspx' webshells observed in an Iranian-Nexus operation against Oman's government.
Microsoft Sentinel (KQL)
