SharePoint CVE-2026-45454 Webshell RCE: w3wp.exe Spawning cmd/powershell

Ibrahim Saud@tektrix

•updated Jun 24, 2026•2•0•8

This rule detects instances where the w3wp.exe (IIS worker process) spawns command-line interpreters like cmd.exe or powershell.exe, and these interpreters execute common discovery commands such as 'whoami', 'hostname', or 'ipconfig'. This behavior can indicate a web server compromise where an attacker is attempting to gain information about the compromised system or network.