Glossary
w3wp.exe
The IIS worker process that hosts ASP.NET applications — its child processes are a key web shell detection signal.
w3wp.exe is the Internet Information Services (IIS) worker process. Each application pool runs one or more w3wp.exe instances, and the pool name appears in its command line (-ap "PoolName").
Because w3wp.exe runs web application code, it rarely needs to start cmd.exe, powershell.exe or discovery tools like whoami.exe. When it does, application code — frequently a web shell — is executing operating-system commands on behalf of a remote user. Parent-child analytics on w3wp.exe are among the most reliable web shell detections on Windows. See process-tree detection.