ToolShell (CVE-2025-53770)

title: SharePoint ToolShell CVE-2025-53770 Exploitation - Web IIS
id: 48d053db-6a56-4866-b60d-0975647050ed
status: experimental
description: |
    Detects access to vulnerable SharePoint components potentially being exploited in CVE-2025-53770 through IIS web server logs.
    CVE-2025-53770 is a zero-day vulnerability in SharePoint that allows remote code execution.
references:
    - https://www.linkedin.com/posts/mauricefielenbach_sharepoint-incidentresponse-windowssecurity-activity-7352653907363303425-bL2f
    - https://research.eye.security/sharepoint-under-siege/
    - https://msrc.microsoft.com/blog/2025/07/customer-guidance-for-sharepoint-vulnerability-cve-2025-53770/
author: Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2025-07-21
tags:
    - attack.initial-access
    - attack.t1190
    - cve.2025-53770
    - detection.emerging-threats
logsource:
    category: webserver # IIS web server logs
detection:
    selection_exploit_post:
        cs-method: 'POST'
        cs-uri-stem|contains: '/_layouts/15/ToolPane.aspx'
        cs-uri-query|contains: 'DisplayMode=Edit&a=/ToolPane.aspx'
    selection_exploit_get:
        cs-method: 'GET'
        cs-uri-stem|contains: '/_layouts/15/spinstall0.aspx'
    selection_referer:
        cs-referer|contains: '/_layouts/SignOut.aspx'
    condition: 1 of selection_exploit_* and selection_referer
falsepositives:
    - Unknown
level: medium

title: Potential SharePoint ToolShell CVE-2025-53770 Exploitation - File Create
id: ba479447-721f-42a9-9af2-6dcd517bbdb3
status: experimental
description: |
    Detects the creation of file such as spinstall0.aspx which may indicate successful exploitation of CVE-2025-53770.
    CVE-2025-53770 is a zero-day vulnerability in SharePoint that allows remote code execution.
references:
    - https://research.eye.security/sharepoint-under-siege/
    - https://msrc.microsoft.com/blog/2025/07/customer-guidance-for-sharepoint-vulnerability-cve-2025-53770/
    - https://unit42.paloaltonetworks.com/microsoft-sharepoint-cve-2025-49704-cve-2025-49706-cve-2025-53770/
author: Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2025-07-21
modified: 2025-07-24
tags:
    - attack.initial-access
    - attack.t1190
    - cve.2025-53770
    - detection.emerging-threats
logsource:
    product: windows
    category: file_event
detection:
    selection:
        TargetFilename|startswith:
            - 'C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\'
            - 'C:\Program Files (x86)\Common Files\Microsoft Shared\Web Server Extensions\'
        TargetFilename|contains:
            - '\15\TEMPLATE\LAYOUTS\'
            - '\16\TEMPLATE\LAYOUTS\'
        TargetFilename|endswith:
            - '\spinstall.aspx'
            - '\spinstall?.aspx'
            - '\debug_dev.js'
    condition: selection
falsepositives:
    - Unknown
level: critical

| tstats count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Web
  WHERE Web.url="*/_layouts/15/ToolPane.aspx*"
    AND
    Web.url="*DisplayMode=Edit*" Web.http_method=POST
  BY Web.http_user_agent, Web.status, Web.http_method,
     Web.url, Web.url_length, Web.src,
     Web.dest, sourcetype
| `drop_dm_object_name("Web")`
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `windows_sharepoint_toolpane_endpoint_exploitation_attempt_filter`

| tstats count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem where Filesystem.file_name="spinstall0.aspx" AND (Filesystem.file_path="*\\microsoft shared\\Web Server Extensions\\16\\TEMPLATE\\LAYOUTS*" OR Filesystem.file_path="*\\microsoft shared\\Web Server Extensions\\15\\TEMPLATE\\LAYOUTS*") by Filesystem.dest Filesystem.user Filesystem.file_create_time Filesystem.file_name Filesystem.file_path Filesystem.action Filesystem.process_guid Filesystem.process_id Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_sharepoint_spinstall0_webshell_file_creation_filter`

DeviceFileEvents 
| where FolderPath has_any ("microsoft shared\\Web Server Extensions\\15\\TEMPLATE\\LAYOUTS", "microsoft shared\\Web Server Extensions\\16\\TEMPLATE\\LAYOUTS") 
| where FileName contains "spinstall" or FileName contains "spupdate" or FileName contains "SpLogoutLayout" or FileName contains "SP.UI.TitleView" 
or FileName contains "queryruleaddtool" or FileName contains "ClientId"
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, FolderPath, ReportId, ActionType, SHA256 
| order by Timestamp desc

// CVE-2025-53770 - WebShell Discovery from w3wp.exe

correlate(
    cmd: {
        #event_simpleName=ProcessRollup2 event_platform=Win FileName="cmd.exe" ParentBaseFileName="w3wp.exe"
          } include: [aid, ComputerName, TargetProcessId, ParentBaseFileName, FileName, CommandLine],
    pwsh: {
        #event_simpleName=ProcessRollup2 event_platform=Win FileName="powershell.exe"
          | aid <=> cmd.aid
          | ParentProcessId <=> cmd.TargetProcessId
          } include: [aid, ComputerName, TargetProcessId, ParentBaseFileName, FileName, CommandLine],
    aspx: {
        #event_simpleName=/^(NewScriptWritten|WebScriptFileWritten)$/ event_platform=Win FileName=/\.aspx/i
          | aid <=> cmd.aid
          | ContextProcessId <=> pwsh.TargetProcessId
          } include: [aid, ComputerName, TargetFileName],
sequence=true, within=5m)

alert http any any -> $HOME_NET any (msg:"ET EXPLOIT Microsoft SharePoint ToolPane Authentication Bypass (CVE-2025-49706)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"|2f|toolpane.aspx|3f|"; fast_pattern; nocase; content:"displaymode|3d|edit"; nocase; content:"|2f|toolpane.aspx"; endswith; nocase; http.referer; content:"|2f|signout.aspx"; nocase; http.request_body; content:"msotlpn_uri|3d|"; nocase; pcre:"/^.*?(?:\x252[fF]|\x2f)_controltemplates(?:\x252[fF]|\x2f).*?(?:\x252[eE]|\x2e)ascx(?:\x26|$)/R"; content:"msotlpn_dwp|3d|"; nocase; reference:url,msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49706; reference:cve,2025-49706; classtype:attempted-user; sid:2063647; rev:1; metadata:affected_product Microsoft_Sharepoint, attack_target Server, tls_state TLSDecrypt, created_at 2025_07_08, cve CVE_2025_49706, deployment Perimeter, deployment Internal, confidence Medium, signature_severity Major, tag Exploit, tag CISA_KEV, updated_at 2025_07_22, former_sid 2863405, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application; target:dest_ip;)

rule WEBSHELL_ASPX_Sharepoint_Drop_CVE_2025_53770_Jul25 {
   meta:
      description = "Detects ASPX web shell dropped during the exploitation of SharePoint RCE vulnerability CVE-2025-53770"
      author = "Florian Roth"
      reference = "https://research.eye.security/sharepoint-under-siege/"
      date = "2025-07-20"
      score = 80
      hash = "27c45b8ed7b8a7e5fff473b50c24028bd028a9fe8e25e5cea2bf5e676e531014"
      hash = "92bb4ddb98eeaf11fc15bb32e71d0a63256a0ed826a03ba293ce3a8bf057a514"
      hash = "b336f936be13b3d01a8544ea3906193608022b40c28dd8f1f281e361c9b64e93"
      id = "f1c8f671-a0d2-5aaf-93f4-025dace0dbe1"
   strings:
      $x1 = "var sy = System.Reflection.Assembly.Load(" ascii
      $x2 = "Response.Write(cg.ValidationKey+" ascii

      $s1 = "<script runat=\"server\" language=\"c#\" CODEPAGE=\"65001\">" ascii fullword
   condition:
      filesize < 4KB
      and 1 of ($x*)
      or all of them
}