cmd.exe spawned from MSExchangeMailboxReplication.exe or w3wp.exe (Exchange post-exploitation)

Ethan Andrews@eandrews

•updated Aug 17, 2026•5•0•10

Detects the spawning of cmd.exe by processes associated with Microsoft Exchange Server, specifically MSExchangeMailboxReplication.exe or w3wp.exe. This activity is indicative of post-exploitation command execution following an exploit of an Exchange web service or MRSProxy endpoint.