hard20 pts · first answer countsedrincident-response
Web server spawning a shell
EDR shows this process tree on an IIS server. What is the most likely explanation?
w3wp.exe (IIS worker, AppPool: Portal)
└─ cmd.exe /c whoami & ipconfig /all
└─ powershell.exe -nop -c "Get-ADUser -Filter *"Discussion 0
Join free to post in the discussion.
Related questions
- Backups that survive ransomwareCybersecurity Analyst
- Why chain of custody mattersCybersecurity Analyst
- NIST incident response lifecycleCybersecurity Analyst
- Suspicious process tree in EDRCybersecurity Analyst
- Containing a hijacked Microsoft 365 accountCybersecurity Analyst
- What EDR host isolation doesCybersecurity Analyst
- What evidence to collect firstCybersecurity Analyst
- File integrity alert on a web serverCybersecurity Analyst