Remote Code Execution vulnerabilities can allow an attacker to move from a vulnerable application into the operating system that hosts it. Although the initial vulnerability may differ from one product to another, the post-exploitation activity often produces similar process relationships that defenders can monitor.
One particularly useful signal is an application or web-server process unexpectedly launching a command shell, scripting engine, or system utility. On Windows, this can provide visibility into the point where exploitation of the application becomes execution on the host.
From Web Application Exploitation to System Commands
The detection focuses on server-side processes such as IIS, WSUS, Tomcat, Java, Apache, Nginx, PHP, and Node.js. These processes normally have predictable execution patterns. When they begin creating child processes such as cmd.exe, powershell.exe, pwsh.exe, wscript.exe, mshta.exe, rundll32.exe, certutil.exe, bitsadmin.exe, or curl.exe, the activity deserves investigation.
The source associates this behavior with RCE affecting SharePoint, WSUS, IIS-hosted applications, SAP on Windows, web management consoles, and vulnerabilities involving deserialization or file upload.
A suspicious process chain may look like:
w3wp.exe → powershell.exe
or:
java.exe → cmd.exe
The process relationship itself is not proof of compromise, but it can indicate that a server-side application has begun executing commands outside its normal application flow.
Detection Query
data.win.system.eventID:1 and data.win.eventdata.parentImage:(*\w3wp.exe or *\wsusservice.exe or *\tomcat*.exe or *\java.exe or *\httpd.exe or *\nginx.exe or *\php-cgi.exe or *\php.exe or *\node.exe) and data.win.eventdata.image:(*\cmd.exe or *\powershell.exe or *\pwsh.exe or *\wscript.exe or *\cscript.exe or *\mshta.exe or *\rundll32.exe or *\regsvr32.exe or *\certutil.exe or *\bitsadmin.exe or *\curl.exe)
The source recorded 15,523 matches during the previous 30 days.
Why the Result Count Matters
A high number of matches does not automatically mean thousands of attacks occurred. Application servers sometimes execute scripts or command-line utilities for legitimate operational reasons. Java applications may call shell commands, Node.js applications may invoke command interpreters, and IIS-hosted systems may run administrative scripts.
For that reason, this query works well as a threat-hunting starting point. The first goal should be to understand which parent-child combinations generate the volume.
Useful groupings include:
parent process;
child process;
hostname;
service account or user;
command line;
execution path;
frequency.
If most events come from one known application server repeatedly launching the same approved script, that behavior can be documented. A rare w3wp.exe → powershell.exe event on an internet-facing server, however, may deserve immediate investigation.
Investigating Suspicious Events
The command line is one of the most important fields to review. A known administrative script has a very different risk profile from an unexpected encoded PowerShell command, an external download URL, or a command that performs discovery.
Analysts should also review activity immediately before and after the process creation event. Useful questions include:
Did the application receive unusual requests before the process started?
Did the child process create additional processes?
Did it write files to temporary or application directories?
Did it make outbound network connections?
Did it modify security settings or persistence mechanisms?
Did similar activity occur on other systems?
The stronger the surrounding evidence, the more confidence the SOC can place in the detection.
Tuning the Detection
The detection should be tuned carefully. Broad exclusions such as ignoring every java.exe → cmd.exe or every w3wp.exe → powershell.exe event could remove valuable security visibility.
A better approach is to create narrow exceptions using combinations such as:
known host + known process path + known command line + known service account
This preserves the behavior-based detection while reducing expected operational noise.
From Hunting Rule to Detection Rule
Once the normal activity in the environment is understood, the same query can be converted into a more precise alert. High-value variants may focus on rare parent-child relationships, unexpected hosts, unusual command lines, external downloads, or execution from user-writable locations.
The key principle is simple: web and application services should not unexpectedly behave like interactive users. Monitoring the moment they begin launching shells or system utilities can provide a valuable signal for detecting RCE and post-exploitation activity.
