SharePoint w3wp.exe spawning LOLBins post CVE-2026-65660 RCE

Ibrahim Saud@tektrix

•updated Sep 22, 2026•0•0•2

Detects instances where the SharePoint IIS worker process (w3wp.exe) initiates command interpreters or known living-off-the-land binaries (LOLBins). This behavior is characteristic of post-exploitation activity, such as command execution following successful exploitation of SharePoint vulnerabilities involving insecure deserialization or malicious directive injection.