ShapedPlugin - w3wp dropping files AND schtasks executing

Ibrahim Saud@tektrix

•updated Jun 19, 2026•0•0•4

This rule detects a highly complex correlation where a web server process (w3wp.exe) drops a file named 'install-persistent.php' and then, within one hour, 'schtasks.exe' executes a command that includes 'install-persistent.php'. This pattern is indicative of a web shell being dropped and then scheduled for execution, potentially as part of a supply chain compromise.