SharePoint w3wp.exe Spawning Shell Post-Exploitation (CVE-2026-65660)

Ibrahim Saud@tektrix

•updated 23 days ago•0•0•4

Detects the SharePoint application pool worker process (w3wp.exe) spawning command-line interpreters or scripting engines. This behavior is indicative of post-exploitation activity where an attacker, having gained remote code execution via techniques like insecure deserialization, executes commands or deploys in-memory webshells within the context of the IIS worker process.