StrikeShark ProxyNotShell CVE-2022-41082 Exchange w3wp Spawning PowerShell

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•3

Detects instances where the Exchange Server IIS worker process (w3wp.exe) spawns unexpected child processes like PowerShell, pwsh, or cmd, often indicating exploitation of vulnerabilities such as ProxyNotShell (CVE-2022-41040 and CVE-2022-41082) where an attacker leverages Exchange backend processes for arbitrary command execution.