IIS Worker Process (w3wp.exe) Spawning a Shell/Interpreter on a SharePoint Server ( CVE-2026-45659 initial exploitation )

Ankit Mehta@Secvyn

•updated Aug 11, 2026•18•2•13

This rule detects suspicious activity originating from an Internet Information Services (IIS) worker process (w3wp.exe) associated with Microsoft SharePoint. It monitors for the spawning of common command-line shells, interpreters, or Living-off-the-Land Binaries (LOLBins) from the SharePoint IIS worker process, which is a potential indicator of Remote Code Execution (RCE) exploitation, specifically targeting vulnerabilities like the hypothetical CVE-2026-45659.