CVE-2026-45454 SharePoint Webshell Deployment via w3wp.exe
Detects the creation of ASPX files in sensitive SharePoint directories (masterpage, layouts) by the w3wp.exe process, which is indicative of web shell deployment. Additionally, this rule identifies instances where w3wp.exe spawns shell processes like cmd.exe or powershell.exe, suggesting potential command execution via a compromised web server.
Microsoft Sentinel (KQL)
