W3WP Launching Encoded PowerShell

Google SecOps@GoogleSecOps

•updated Sep 29, 2025•1•0•88

Detects the execution of an encoded PowerShell command where the parent process is w3wp.exe. This behavior is often indicative of an attacker leveraging a compromised web server (IIS) to execute malicious PowerShell scripts, potentially for further reconnaissance, privilege escalation, or payload delivery. The rule includes exclusions for known legitimate PowerShell scripts to reduce false positives.