Emerging Threathighexperimental

Suspicious Process Spawned by CentreStack Portal AppPool

Detects unexpected command shell execution (cmd.exe) from w3wp.exe when tied to CentreStack's portal.config, indicating potential exploitation (e.g., CVE-2025-30406)

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Jason Rathbun (Blackpoint Cyber)Created Thu Apr 172d79e371-2a27-42de-87a4-b4213fc72a6a2025

Emerging Threat

Active Threat

Developed to detect an active or emerging threat. Prioritize investigation of any alerts and correlate with threat intelligence.

Log Source

WindowsProcess Creation

ProductWindows← raw: windows

CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic

detection:
    selection:
        ParentImage|endswith: '\w3wp.exe'
        ParentCommandLine|contains: '\portal\portal.config'
        Image|endswith: '\cmd.exe'
    condition: selection

False Positives

Potentially if other portal services run on w3wp with a apppool\portal\portal.config, if you want to increase scope you could add user IIS APPPOOL\portal.

References

gladinetsupport.s3.us-east-1.amazonaws.com

Resolving title…

bleepingcomputer.com

MITRE ATT&CK

Tactics

TA0003 · Persistence TA0002 · Execution