T1505.003: SharePoint w3wp.exe Post-Exploitation Malware Deployment

Tim Peck@timpeck

•updated Jul 23, 2026•72•1•108

Detects potential post-exploitation activity originating from the SharePoint worker process (w3wp.exe). The rule monitors for three primary indicators: w3wp.exe spawning command interpreters (cmd.exe or powershell.exe), unauthorized file modifications or creations within SharePoint web directories, and outbound network connections to public IP addresses initiated by w3wp.exe, which may indicate payload delivery or C2 communication. (CVE-2026-50522)