StrikeShark w3wp.exe Spawning Shell Processes - Exchange/SharePoint Web Shell

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•2

Detects instances where the IIS worker process (w3wp.exe) initiates execution of suspicious binaries such as cmd.exe, powershell.exe, or other scripting tools. This behavior is a common indicator of web shell exploitation on internet-facing servers like Microsoft Exchange or SharePoint.