CmdID / Files

w3wp.exe

IIS Worker Process file version info

Program on Windows 6 known copies with hashes 20 Sigma rules name it

Is it the real w3wp.exe?

file version info and known copies

Installed inC:\Windows\system32\inetsrv\
C:\Windows\SysWOW64\inetsrv\

Signed byMicrosoft Windows

ProductInternet Information Services, Microsoft Corporation

DescriptionIIS Worker Process

6 known copies

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\inetsrv\w3wp.exe · signed by Microsoft Windows

1eb51ea7407f41bc212cc699e37727ad6e6d52ec6746119ea066bd901f5e143b

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\inetsrv\w3wp.exe · signed by Microsoft Windows

3fb9f0b5e922208c56707fe98133265c1676a9937adcb7dbeabc3eb67a05c22b

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\inetsrv\w3wp.exe · signed by Microsoft Windows

3bd48eecd731f843b4416c46c254d2efb78a5f77105c341fc8fd888956f1fb64

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\inetsrv\w3wp.exe · signed by Microsoft Windows

a0a37fde4d8cd7385e819afa967bc525231c2f166c38591532d8feeab94e40da

8.5.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\inetsrv\w3wp.exe · not signed

6cd7cc4b72db91f168c36c500c1be9ae391c1ff09cd65295bb24267d35373fd9

8.5.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\inetsrv\w3wp.exe · not signed

bbeceb8dbeb159152b1d1b63aa4a23bb97a93ee7e63271213c181d3064f2ddf3

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name w3wp.exe

highChopper Webshell Process PatternFlorian Roth (Nextron Systems), MSTI (query)

highCsc.EXE Execution Form Potentially Suspicious ParentFlorian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems)

highExploitation Activity of CVE-2025-59287 - WSUS Suspicious Child ProcessHuntress Labs, Swachchhanda Shrawan Poudel (Nextron Systems)

highPotential SharePoint ToolShell CVE-2025-53770 Exploitation IndicatorsSwachchhanda Shrawan Poudel (Nextron Systems)

highSuspicious IIS Module RegistrationFlorian Roth (Nextron Systems), Microsoft (idea)

highSuspicious PowerShell Parent ProcessTeymur Kheirkhabarov, Harish Segar

highSuspicious Process By Web Server ProcessThomas Patzke, Florian Roth (Nextron Systems), Zach Stanford @svch0st, Tim Shelton, Nasreddine Bencherchali (Nextron Systems)

highSuspicious Process Spawned by CentreStack Portal AppPoolJason Rathbun (Blackpoint Cyber)

highWebshell Detection With Command Line KeywordsFlorian Roth (Nextron Systems), Jonhnathan Ribeiro, Anton Kutepov, oscd.community, Chad Hudson, Matt Anderson

highWebshell Hacking Activity PatternsFlorian Roth (Nextron Systems)

highWebshell Tool Reconnaissance ActivityCian Heasley, Florian Roth (Nextron Systems)

mediumDynamic .NET Compilation Via Csc.EXEFlorian Roth (Nextron Systems), X__Junior (Nextron Systems)

mediumPotential MOVEit Transfer CVE-2023-34362 Exploitation - Dynamic Compilation Via Csc.EXE@kostastsale

Sigma names w3wp.exe in 20 rules in all, for every kind of event; these are the process creation rules CmdID evaluates.