Suspicious child process spawned by SharePoint w3wp.exe (CVE-2026-56164)

Daniel Gfall@Qryptic

•updated Jul 27, 2026•23•1•35

Detects instances where the Internet Information Services (IIS) worker process (w3wp.exe) initiates execution of suspicious binaries such as cmd.exe, powershell.exe, or other script interpreters, which may indicate web-based exploitation or lateral movement.