StrikeShark Web Shell Deployment via w3wp.exe on Exchange/SharePoint

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•4

Detects when the IIS worker process (w3wp.exe) spawns common command-line interpreters (cmd.exe, powershell.exe, pwsh.exe). This behavior is often a strong indicator of webshell activity or exploitation of web applications such as Microsoft Exchange or SharePoint.