Suspicious SharePoint Activity
This rule detects the creation of a new process (cmd.exe) that is spawned by a w3wp.exe process, which itself is a child of svchost.exe, and where the command line of the w3wp.exe process contains the string "SharePoint". This chain of events could indicate suspicious activity within a SharePoint environment, potentially an attacker executing commands via a compromised IIS worker process.
SentinelOne
