Adobe ColdFusion Exploitation - w3wp or cfusion Spawning Shell or Download Cradle

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•5

Detects suspicious child process creation originating from Adobe ColdFusion or IIS worker processes (w3wp.exe). This rule monitors for the execution of command-line shells, scripting engines, or download utilities often used in exploitation of vulnerabilities like CVE-2023-26360, CVE-2023-29298, or CVE-2023-29300.