w3wp.exe Spawning OS Enumeration Commands — Webshell Execution (T1505.003)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•4

Detects the execution of common reconnaissance or command-line utilities (e.g., whoami, net, powershell, cmd) spawned by the IIS worker process (w3wp.exe). This pattern is a strong indicator of post-exploitation activity or web shell usage on a compromised web server.