Which w3wp exe

Figure 8. The web pages are executed within these processes. Skip to main content. Professional Microsoft IIS 8 by. Start your free trial. We expect to see w3wp. The process of execution should look like this: Services. So what did we detect? Case 2 w3wp. The output of these processes were fed to its child processes. How does this chain of execution look in a tool such as Carbon Black?

What process was observed that started this all? You guessed it: w3wp. Detection opportunity Several of our detectors were triggered to flag this activity. PowerShell script for enumerating w3wp. Name -eq "cmd. The 2nd script is needed to work with this script, Get-W3WP.

Credit: Adam Roben for pstree. ParentProcessId -eq 0 -or! Related Articles. Detection and response Intelligence Insights: October Detection and response Better know a data source: Process command line. Detection and response Intelligence Insights: September Subscribe to our blog. See what it's like to have a partner in the fight. Experience the difference between a sense of security and actual security. Download the report All Threat Detection Report content is fully available through this website.

Thanks for your interest! Check your inbox, the Threat Detection Report is headed your way. Our website uses cookies to provide you with a better browsing experience.

More information can be found in our Privacy Policy. Within IIS you can set up websites and which application pools they are assigned. Multiple websites can be assigned to a single IIS application pool. To learn more about web sites, web applications, and application pools within IIS, check out the Microsoft docs. A defined IIS application pool is what becomes a w3wp.

They have two basic settings which are related to the version of. NET being used. IIS application pools also provide a bunch of advanced settings. These impact the behavior of w3wp and your IIS worker process. Including things like what Windows user account it runs as, auto restarting of the process, auto shutdown, and more. It is also possible for one IIS application pool to create multiple IIS worker processes in what is called a web garden.

Via the Windows Task Manager, you can see processes named w3wp. Within the IIS management console, you can view more details. Open IIS manager and on the left side click on the name of your computer. You will then see a similar list of icons on the right as shown in the screenshot below.

On the Worker Processes screen, you can see more details than you would be able to see from Windows Task Manager. If you want to go even a step further, you can double click on a worker process to see which web requests are currently executing within your IIS worker process. There is one key thing you need to know about IIS application pools that are a little confusing.