w3wp.exe Spawning OS Enumeration Commands - Webshell Execution

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•4

Detects instances where an IIS worker process (w3wp.exe) spawns common Windows OS enumeration tools or commands (whoami, cmd.exe, net.exe, etc.). This behavior is a common indicator of post-exploitation activity, typically involving the use of a web shell on an IIS or ColdFusion web server.