IIS Worker Process Spawning Suspicious Child Processes

Ethan Andrews@eandrews

•updated May 26, 2026•4•0•146

Monitors the IIS worker process (w3wp.exe) for the execution of suspicious child processes such as cmd.exe, powershell.exe, and whoami.exe. This behavior is commonly associated with post-exploitation reconnaissance and execution via web shells, including those deployed during KnowledgeDeliver ViewState deserialization attacks.