SharePoint IIS Worker Process Spawning Reconnaissance Tools
This rule detects the creation of common reconnaissance and shell utilities (whoami.exe, hostname.exe, ipconfig.exe, cmd.exe, powershell.exe) by the IIS worker process (w3wp.exe) on Windows systems. This activity is often indicative of a web application compromise, such as a SharePoint vulnerability (e.g., path traversal), where an attacker leverages the web server to execute system commands for discovery or further exploitation. The rule specifically targets Security Event ID 4688 (process creation) and filters for processes spawned by w3wp.exe.
Microsoft Sentinel (KQL)
