ASPX Web Shell Deployment via w3wp.exe Spawning cmd.exe or powershell.exe

Ibrahim Saud@tektrix

•updated Jun 27, 2026•0•0•2

This rule detects instances where the IIS web server process (w3wp.exe) spawns common command-line interpreters such as cmd.exe or powershell.exe. This activity is a classic indicator of a successful web application exploit, potentially leading to remote code execution.