IIS Worker Web Shell and Config Discovery Hunt (AntiFox)

Goksel Atakan@gokselatakan

•updated yesterday•6•0•12

Detects IIS worker processes (w3wp.exe) that start shells, run whoami or icacls, search for web.config files, read connection strings through PowerShell or write .aspx and config copy files, which matches the web shell and configuration discovery steps reported in AntiFox intrusions. Needs Defender for Endpoint on the IIS servers, and file events can be sparse. Logic tested with synthetic events and run against live Defender data.