Threat Research

"Investigating A Web Shell Intrusion" details an incident where endpoint sensors detected suspicious activity from an IIS worker (w3wp.exe). The attacker uploaded a web shell to the IIS server, which was previously unrestricted....