SharePoint ToolShell chain: w3wp.exe spawns shell after ToolPane RCE

This rule detects unauthorized process creation from the SharePoint worker process (w3wp.exe). It specifically monitors for the spawning of command-line shells or scripting engines, which is indicative of exploitation activity such as remote code execution (RCE) attempts against SharePoint services, including deserialization attacks.