CL-STA-1062 ASPX Web Shell Deployment and w3wp.exe Spawning Child Processes
This rule detects potential web shell activity on Windows IIS servers by monitoring for two suspicious behaviors: the w3wp.exe process spawning shell processes (cmd.exe or powershell.exe) and the creation or modification of .aspx files within common web root directories (\wwwroot\, \inetpub\). These are common indicators of web shell installation and subsequent remote command execution.
Microsoft Sentinel (KQL)
