SharePoint Webshell Execution via Encoded PowerShell from w3wp.exe

Sotiris Mavrakis@smavrakis

•updated Jul 21, 2025•1•36

Detects suspicious PowerShell execution via cmd.exe spawned by w3wp.exe (IIS worker process), using encoded payloads that decode to indicators like 'spinstall0', '.aspx', or SharePoint layouts paths. This technique has been observed in post-exploitation of SharePoint CVEs (CVE-2025-53770).