IIS worker process spawning shells consistent with ToolShell/Telerik UI RCE exploitation
This rule monitors for Microsoft IIS worker processes (w3wp.exe) initiating common command-line shells or scripting engines. This behavior is indicative of successful remote code execution exploitation against internet-facing web applications, such as SharePoint or Telerik UI, often via deserialization vulnerabilities.
Microsoft Sentinel (KQL)
