{
	"id": "01c3c9d6-8dfb-47ca-94f4-84ae03ad855b",
	"created_at": "2026-04-06T00:19:22.178394Z",
	"updated_at": "2026-04-10T13:12:20.193999Z",
	"deleted_at": null,
	"sha1_hash": "112ca316b14f67f3a77e04262087b7ab15569423",
	"title": "Microsoft-365-Defender-Hunting-Queries/Execution/exchange-iis-worker-dropping-webshell.md at master · microsoft/Microsoft-365-Defender-Hunting-Queries",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 54348,
	"plain_text": "Microsoft-365-Defender-Hunting-Queries/Execution/exchange-iis-worker-dropping-webshell.md at master · microsoft/Microsoft-365-\r\nDefender-Hunting-Queries\r\nBy Louie Mayor\r\nArchived: 2026-04-05 16:21:30 UTC\r\nSkip to content\r\nNavigation Menu\r\nAI CODE CREATION\r\nGitHub CopilotWrite better code with AI\r\nGitHub SparkBuild and deploy intelligent apps\r\nGitHub ModelsManage and compare prompts\r\nMCP RegistryNewIntegrate external tools\r\nView all features\r\nPricing\r\nSign up\r\nThis repository was archived by the owner on Nov 16, 2023. It is now read-only.\r\nNotifications\r\nFork 574\r\nStar 2.1k\r\nLatest commit\r\nhttps://github.com/microsoft/Microsoft-365-Defender-Hunting-Queries/blob/master/Execution/exchange-iis-worker-dropping-webshell.md\r\nPage 1 of 2\n\nLouie Mayor\r\nMar 5, 2021\r\nSource: https://github.com/microsoft/Microsoft-365-Defender-Hunting-Queries/blob/master/Execution/exchange-iis-worker-dropping-webshel\r\nl.md\r\nhttps://github.com/microsoft/Microsoft-365-Defender-Hunting-Queries/blob/master/Execution/exchange-iis-worker-dropping-webshell.md\r\nPage 2 of 2",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"MISPGALAXY",
		"Malpedia"
	],
	"origins": [
		"web"
	],
	"references": [
		"https://github.com/microsoft/Microsoft-365-Defender-Hunting-Queries/blob/master/Execution/exchange-iis-worker-dropping-webshell.md"
	],
	"report_names": [
		"exchange-iis-worker-dropping-webshell.md"
	],
	"threat_actors": [],
	"ts_created_at": 1775434762,
	"ts_updated_at": 1775826740,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/112ca316b14f67f3a77e04262087b7ab15569423.pdf",
		"text": "https://archive.orkl.eu/112ca316b14f67f3a77e04262087b7ab15569423.txt",
		"img": "https://archive.orkl.eu/112ca316b14f67f3a77e04262087b7ab15569423.jpg"
	}
}