CVE-2020-0688 Exchange ECP Exploitation: w3wp Child Process + Webshell Drop

Arnold Chan@slaz

•updated Sep 16, 2026•0•0•4

This rule detects potential web shell creation on a Microsoft Exchange server by monitoring for suspicious child processes spawned by the IIS web server process (w3wp.exe) that correlate with the creation or modification of web-accessible script files (.aspx, .ashx, .asp, .dll) within the Exchange virtual directories (ecp, owa, aspnet_client). This pattern is consistent with common post-exploitation activities used by attackers to gain persistent access via web shells.