Sigma Rules

Suspicious Process Spawned by CentreStack Portal AppPool

Detects unexpected command shell execution (cmd.exe) from w3wp.exe when tied to CentreStack's portal.config, indicating potential exploitation (e.g., CVE-2025-30406)