Suspicious Child Process Of Iis Worker Process

nomit vyas@xoxo

•updated Sep 18, 2025•2•1•13,644

Detects the IIS worker process (w3wp.exe) spawning suspicious child processes like command shells or reconnaissance tools. This is a common post-exploitation pattern observed after compromise of web applications, particularly Microsoft Exchange Server.