Suspicious IIS/OWA-ECP process spawning DLL loader (FamousSparrow)

Ankit Mehta@Secvyn

•updated Sep 17, 2026•1•0•2

Detects instances where common Windows web server processes (w3wp.exe or UMWorkerProcess.exe) initiate suspicious child processes (cmd.exe, powershell.exe, etc.) within a short duration of a file modification event involving known potentially malicious DLL files (winfsp-x64.dll or DukeQt.dll), characteristic of web shell exploitation or post-compromise activity on Exchange/IIS servers.