IIS w3wp.exe Spawning cmd.exe or PowerShell - ASPX Web Shell Execution

Ibrahim Saud@tektrix

•updated Jun 27, 2026•0•0•0

Detects instances where the Internet Information Services (IIS) worker process (w3wp.exe) spawns a command shell (cmd.exe) or PowerShell (powershell.exe, pwsh.exe). This behavior is highly suspicious as it often indicates a web application compromise or exploit attempt where an adversary has gained remote code execution.