LOLBAS - Powershell - W3WP Initiating Outbound Web Requests

Marcus Mingo@meeengoh

•updated Jul 3, 2025•10•0•82

Detects suspicious usage of PowerShell making outbound web requests initiated by the IIS Worker Process (w3wp.exe), which may indicate webshell activity or post-exploitation behavior through living-off-the-land techniques. This rule specifically looks for `Invoke-Expression`, `Invoke-WebRequest`, or `Invoke-RestMethod` patterns when launched from w3wp.exe and not by the NT AUTHORITY account.