Detection catalogue

Explore published rules with transparent provenance, licensing, and ATT&CK mappings.

detections

Loading detections…

Microsoft Exchange Worker Spawning Suspicious Processes

Identifies suspicious processes being spawned by the Microsoft Exchange Server worker process (w3wp). This activity may indicate exploitation activity or access to an existing web shell backdoor.

ATT&CK coverage

Outside the enterprise matrix

T1059Command and Scripting Interpreter 488 detections cover this technique
T1059.001PowerShell 362 detections cover this technique
T1059.003Windows Command Shell 88 detections cover this technique
T1190Exploit Public-Facing Application 342 detections cover this technique
T1505Server Software Component 52 detections cover this technique
T1505.003Web Shell 70 detections cover this technique

Detection requirements

Log source category: event_index

What the source says

References

https://discuss.elastic.co/t/detection-and-response-for-hafnium-activity/266289
https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers
https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities

Tagged by the source as

Data Source: Elastic DefendData Source: Elastic EndgameData Source: Microsoft Defender XDRData Source: SentinelOneData Source: SysmonDomain: EndpointOS: WindowsResources: Investigation GuideTactic: Initial AccessUse Case: Threat Detection

Detection logic

Published to signed-in readers

The query as its source wrote it, its canonical form, and the content hash that pins this exact revision.