MITRE ATT&CK KQL Explorer

697 techniques · 102 KQL queries · 71 with detections

Has KQL

T1190Exploit Public-Facing Application

Initial Access

View on MITRE ATT&CK →

2 Queries

Storm-1175 / Medusa — Anomalous Process Spawn from Web Server Worker

hightestingMicrosoft Sentinel

Microsoft Defender for Endpoint·DeviceProcessEvents

// Anomalous process spawns from web server worker processes (IIS / SharePoint)
DeviceProcessEvents
| where InitiatingProcessFileName in~ ("w3wp.exe", "wsmprovhost.exe", "svchost.exe")
| where FileName in~ ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "certutil.exe", "bitsadmin.exe")
| where InitiatingProcessCommandLine has_any ("inetpub", "SharePoint", "wwwroot")
| project Timestamp, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, AccountName
| order by Timestamp desc

triathIC · last tested 2026-04-28

Tuning notes

Inventory internet-exposed SharePoint/IIS assets and verify patch status (e.g., CVE-2026-32201). Whitelist known administrative tooling and monitoring agents that legitimately spawn cmd/PowerShell from w3wp.exe. Tighten by anchoring InitiatingProcessCommandLine to the actual web-root paths used in the environment.

+ Add another query for this technique →