Rule Info
Name
Suspicious Process Spawned by CentreStack Portal AppPool
Author
Jason Rathbun (Blackpoint Cyber)
Description
Detects unexpected command shell execution (cmd.exe) from w3wp.exe when tied to CentreStack's portal.config, indicating potential exploitation (e.g., CVE-2025-30406)
Date
2025-04-17 00:00:00
Modified
None
Id
2d79e371-2a27-42de-87a4-b4213fc72a6a
Tags
attack.execution attack.t1059.003 attack.t1505.003 cve.2025-30406 detection.emerging-threats
Type
Community Rule
Link to Public Repo
Rule History
Author
Title
Date
Commit
RG9n
Merge PR #5263 from @RG9n - Add `Suspicious Process Spawned by CentreStack Portal AppPool`
2025-04-17
Scan your endpoints, forensic images or collected files with our portable scanner THOR