StrikeShark Web Shell Drop to IIS Web Root via w3wp or UMWorkerProcess
Detects the creation of web-executable files (e.g., .aspx, .ashx, .php, .jsp, .asmx) within sensitive web root directories (IIS, Exchange, SharePoint) when the writing process is identified as an IIS worker process (w3wp.exe) or an Exchange Unified Messaging worker process (UMWorkerProcess.exe). This activity is highly indicative of web shell deployment for post-exploitation persistence, commonly associated with vulnerabilities like CVE-2021-26855 or CVE-2022-41082.
YARA-L
