cmd.exe spawned from IIS worker process hosting Exchange app pool (webshell exec pattern)
Detects the execution of cmd.exe as a child process of the IIS worker process (w3wp.exe) when the worker process is associated with an Exchange application pool. This pattern is indicative of a webshell exploiting an ASPX component to execute arbitrary commands on an Exchange Server.
Microsoft Sentinel (KQL)
