IIS w3wp.exe spawning shells or recon tools (ViewState deserialization RCE)
Detects when the Internet Information Services (IIS) worker process (w3wp.exe) spawns suspicious child processes, command interpreters, or reconnaissance utilities, which may indicate web shell activity, remote code execution (RCE) via ViewState deserialization, or other web application exploitation.
Microsoft Sentinel (KQL)
