Web Server Reconnaissance Command Sequence (IIS / w3wp.exe Exploitation)

Ankit Mehta@Secvyn

•updated Aug 5, 2026•1•0•4

This rule monitors for a sequence of suspicious discovery commands (e.g., whoami, net, ipconfig) executed by web server processes (IIS w3wp.exe, Apache httpd, Nginx, or Tomcat). By requiring a threshold of at least three distinct discovery tools being executed by the same process within a 24-hour period, the rule identifies potential post-exploitation reconnaissance activity following a web server compromise.