{"slug":"toolshell","title":"ToolShell (CVE-2025-53770)","shortName":"ToolShell","summary":"Unauthenticated deserialization RCE chain against on-premises Microsoft SharePoint Server, evolving from the Pwn2Own ToolShell bugs CVE-2025-49704 and CVE-2025-49706. Exploited in the wild from mid-Jul 2025. CVE-2025-53770 listed in CISA KEV on 20 Jul 2025.","isExample":false,"draft":false,"family":"toolshell","kind":"single-product","aliases":["CVE-2025-53770","CVE-2025-53771","CVE-2025-49704","CVE-2025-49706","SharePoint ToolShell"],"publishedAt":"2025-07-20","updatedAt":"2026-10-24","patchStatus":"patched","exploited":true,"scores":{"cve":"CVE-2025-53770","cvss":{"cve":"CVE-2025-53770","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1","scorer":"cna","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-53770","sourceDate":"2026-08-04","checkedDate":"2026-10-24"},"epss":{"cve":"CVE-2025-53770","score":0.99999,"percentile":0.99992,"date":"2026-10-23","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-53770","checkedDate":"2026-10-24"},"kev":{"cve":"CVE-2025-53770","listed":true,"dateAdded":"2025-07-20","dueDate":"2025-07-21","catalogVersion":"2026.10.23","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","checkedDate":"2026-10-24"},"addedDate":"2026-10-24"},"priority":{"label":"act-now"},"managementSummary":{"what":"Unauthenticated deserialization remote code execution against on-premises SharePoint (CVE-2025-53770). Exploited from mid-July 2025 and listed in CISA KEV.","action":"Install the July 2025 SharePoint updates, enable AMSI Full Mode, rotate ASP.NET machine keys, and hunt for ToolPane posts and spinstall webshells."},"seenInTheWild":[{"metric":"exposed","value":9762,"observer":"Censys","date":"2025-07-21","method":"On-prem SharePoint servers online; patch status not inferable","sourceUrl":"https://censys.com/advisory/cve-2025-53770/"},{"metric":"possibly-vulnerable","value":424,"observer":"Shadowserver (scan by LeakIX)","date":"2025-07-23","method":"IPs confirmed vulnerable","sourceUrl":"https://infosec.exchange/@shadowserver/114906950312458642"},{"metric":"exposed","value":"~17K IPs exposed; 840 with CVE-2025-53770 (version based only); at least 20 with webshells","observer":"Shadowserver","date":"2025-07-31","method":"vhost and version detection with Validin and CERT-Bund","sourceUrl":"https://infosec.exchange/@shadowserver/114947937816601435","note":"Post date; snapshot date not stated."},{"metric":"exposed","value":9665,"observer":"Censys","date":"2025-08-03","method":"On-prem SharePoint exposed; vulnerability status not confirmable","sourceUrl":"https://censys.com/advisory/cve-2025-53770/"},{"metric":"scanning","value":"first request to the vulnerable endpoint seen 16 Jul 2025","observer":"GreyNoise","date":"2025-07-16","method":"Sensor request to ToolPane.aspx labelled suspicious","sourceUrl":"https://censys.com/advisory/cve-2025-53770/"},{"metric":"exposed","value":21701,"observer":"Shodan","date":"2026-10-23","method":"Product query \"MicrosoftSharePointTeamServices\"","sourceUrl":"https://www.shodan.io/search?query=%22MicrosoftSharePointTeamServices%22","note":"Exposed hosts. Data: Shodan."},{"metric":"exploitation-confirmed","value":"Listed","observer":"CISA","date":"2025-07-20","method":"CISA Known Exploited Vulnerabilities catalog dateAdded","sourceUrl":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog"}],"seenInTheWildLinks":[{"title":"Microsoft SharePoint CVE-2025-53770 (ToolShell) Attempt","url":"https://viz.greynoise.io/tags/microsoft-sharepoint-cve-2025-53770--toolshell--attempt","observer":"GreyNoise","metric":"scanning"},{"title":"Microsoft SharePoint ToolShell spinstall0.aspx Implant Check","url":"https://viz.greynoise.io/tags/microsoft-sharepoint-toolshell-spinstall0-aspx-implant-check","observer":"GreyNoise","metric":"scanning"}],"whatChanged":{"date":"2026-10-24","items":[{"text":"Added Am I affected checks, mitigations and response guidance","section":"am-i-affected"},{"text":"Act-now priority block with sourced CVSS, EPSS, and CISA KEV dates.","section":"priority","addedDate":"2026-10-24"},{"text":"Detection rule coverage table and JSON, IOC CSV, and STIX feeds.","section":"detection","addedDate":"2026-10-24"}]},"whatTheBugIs":"ToolShell is the public name for an unauthenticated exploit chain against on-premises Microsoft SharePoint Server. Code White GmbH reproduced the chain from two Pwn2Own Berlin bugs, CVE-2025-49706 (authentication bypass) and CVE-2025-49704 (deserialization RCE), and Eye Security identified large-scale exploitation on the evening of 18 Jul 2025.\n\nMicrosoft later assigned CVE-2025-53770 for deserialization of untrusted data enabling unauthorized code execution over a network, and CVE-2025-53771 for related spoofing. NVD quotes Microsoft: an exploit for CVE-2025-53770 exists in the wild. SharePoint Online in Microsoft 365 is not affected.\n\nObserved attacks POST to the ToolPane endpoint with a Referer of /_layouts/SignOut.aspx, drop variants of spinstall0.aspx, and steal ASP.NET machine keys. Microsoft attributes exploitation to China-nexus actors Linen Typhoon, Violet Typhoon, and Storm-2603 (the last also linked to Warlock / LockBit ransomware).","attackPath":{"caption":"High-level only. Not a reproduction guide.","steps":[{"id":"bypass","label":"Auth bypass","detail":"Unauthenticated request reaches SharePoint ToolPane with a crafted Referer that bypasses authentication checks."},{"id":"deser","label":"Unsafe deserialize","detail":"SharePoint deserializes attacker-controlled data (CVE-2025-49704 / CVE-2025-53770 class)."},{"id":"shell","label":"Web shell / key theft","detail":"Attackers drop spinstall0.aspx (or variants) and steal ASP.NET machine keys."},{"id":"persist","label":"Follow-on access","detail":"Stolen keys and webshells enable persistent access and further post-exploitation. Conceptual impact class only."}]},"exploitation":{"kev":{"listed":true,"date":"2025-07-20","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","note":"CISA KEV entries include CVE-2025-53770 (dateAdded 2025-07-20), CVE-2025-49704 and CVE-2025-49706 (dateAdded 2025-07-22). knownRansomwareCampaignUse Known for these entries."},"firstSeen":{"date":"2025-07-07","source":"Microsoft Security Blog","note":"Microsoft analysis suggests threat actors were attempting to exploit CVE-2025-49706 and CVE-2025-49704 as early as 7 Jul 2025. Eye Security identified large-scale exploitation on the evening of 18 Jul 2025."},"vendorStatements":[{"vendor":"Microsoft","date":"2025-07-20","statement":"Microsoft is aware that an exploit for CVE-2025-53770 exists in the wild. Affects on-premises SharePoint Server only; SharePoint Online is not affected.","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53770","retracted":false},{"vendor":"Microsoft Threat Intelligence","date":"2025-07-22","statement":"Microsoft has observed two named Chinese nation-state actors, Linen Typhoon and Violet Typhoon, exploiting these vulnerabilities targeting internet-facing SharePoint servers. Storm-2603 has been observed deploying ransomware.","url":"https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/","retracted":false},{"vendor":"Eye Security","date":"2025-07-18","statement":"On the evening of July 18, 2025, Eye Security was the first in identifying large-scale exploitation of a SharePoint ToolShell chain.","url":"https://research.eye.security/sharepoint-under-siege/","retracted":false}]},"timeline":[{"date":null,"event":"CVE-2025-49704 and CVE-2025-49706 presented at Pwn2Own Berlin (ToolShell chain), May 2025.","source":{"title":"SharePoint Under Siege: ToolShell Exploit","url":"https://research.eye.security/sharepoint-under-siege/","publisher":"Eye Security"},"kind":"disclosure","key":true},{"date":"2025-07-07","event":"Microsoft assesses earliest exploitation attempts against CVE-2025-49706 / CVE-2025-49704.","source":{"title":"Disrupting active exploitation of on-premises SharePoint vulnerabilities","url":"https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/","publisher":"Microsoft"},"kind":"exploited","key":true},{"id":"exploitation-attempts","date":"2025-07-18","event":"Eye Security identifies large-scale ToolShell exploitation in customer telemetry.","source":{"title":"SharePoint Under Siege","url":"https://research.eye.security/sharepoint-under-siege/","publisher":"Eye Security"},"kind":"exploited","key":true},{"date":"2025-07-19","event":"Microsoft releases out-of-band guidance and begins shipping comprehensive updates.","source":{"title":"Disrupting active exploitation of on-premises SharePoint vulnerabilities","url":"https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/","publisher":"Microsoft"},"kind":"patch","key":true},{"date":"2025-07-20","event":"CVE-2025-53770 published. CISA adds it to KEV and alerts defenders.","source":{"title":"Microsoft Releases Guidance on Exploitation of SharePoint Vulnerability","url":"https://www.cisa.gov/news-events/alerts/2025/07/20/microsoft-releases-guidance-exploitation-sharepoint-vulnerability-cve-2025-53770","publisher":"CISA"},"kind":"kev","key":true},{"date":"2025-07-22","event":"Microsoft details Linen Typhoon, Violet Typhoon, and Storm-2603 activity, plus KB5002768 / KB5002754 / KB5002760 updates.","source":{"title":"Disrupting active exploitation of on-premises SharePoint vulnerabilities","url":"https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/","publisher":"Microsoft"},"kind":"vendor","key":true}],"defenderActions":[{"title":"Install the SharePoint security updates","detail":"Apply the July 2025 comprehensive updates for Subscription Edition (KB5002768), SharePoint 2019 (KB5002754 / language pack KB5002753), and SharePoint 2016 (KB5002760 / language pack KB5002759). SharePoint Online needs no action.","priority":"now","links":[{"label":"Microsoft SharePoint guidance","href":"https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/"}]},{"title":"Enable AMSI Full Mode on SharePoint","detail":"Microsoft says enabling Antimalware Scan Interface integration with Microsoft Defender Antivirus (or equivalent) in Full Mode helps stop unauthenticated attacks. If AMSI cannot be enabled, consider removing internet exposure until patched.","priority":"now"},{"title":"Rotate ASP.NET machine keys and restart IIS","detail":"After patching or enabling AMSI, rotate SharePoint server ASP.NET machine keys and restart IIS on all SharePoint servers. Stolen keys survive webshell cleanup.","priority":"now"},{"title":"Hunt for ToolPane posts and spinstall webshells","detail":"Search IIS logs for POSTs to /_layouts/15/ToolPane.aspx with Referer /_layouts/SignOut.aspx, and for spinstall0.aspx / spinstall.aspx / spinstallN.aspx under layouts paths.","priority":"soon","links":[{"label":"Eye Security ToolShell report","href":"https://research.eye.security/sharepoint-under-siege/"}]}],"detection":[{"title":"ToolPane POST with SignOut Referer","detail":"Eye Security and Microsoft highlight POSTs to /_layouts/15/ToolPane.aspx (DisplayMode=Edit) with Referer /_layouts/SignOut.aspx as the observed exploit request shape.","logSource":"Web access logs / reverse-proxy logs","kind":"generic","group":"web-proxy"},{"title":"spinstall webshell files","detail":"Microsoft observed spinstall0.aspx and renamed variants used to return MachineKey material. Search SharePoint layouts directories and Defender for Endpoint alerts for those filenames.","logSource":"EDR / process telemetry","kind":"generic","group":"edr"},{"title":"w3wp.exe post-exploitation commands","detail":"Microsoft describes command execution via the SharePoint w3wp.exe worker process after initial access, followed by discovery and GPO-based ransomware staging in Storm-2603 cases.","logSource":"EDR / process telemetry","kind":"generic","group":"edr"},{"title":"Akamai App & API Protector: rule 3000969","detail":"Rapid Rule 3000969 'SharePoint RCE Detected (CVE-2025-49704, CVE-2025-53770)' released 2025-07-21, deny default from 2025-07-22.","logSource":"Akamai Security Events (WAF) logs","kind":"vendor-signature","url":"https://www.akamai.com/blog/security-research/sharepoint-vulnerability-rce-active-exploitation-detections-mitigations","date":"2025-07-21"},{"title":"NetScaler WAF signatures: 998255 / 998258","detail":"NetScaler WAF signature update version 157: rule 998255 (SharePoint auth bypass, CVE-2025-49706 / CVE-2025-53771) and 998258 (SharePoint deserialization, CVE-2025-49704 / CVE-2025-53770).","logSource":"NetScaler WAF (AppFw) logs","kind":"vendor-signature","url":"https://docs.netscaler.com/en-us/citrix-adc/13-1/signature-alerts/signature-update-version-157.html","date":"2026-10-23","dateKind":"checked"},{"title":"Cloudflare WAF Managed Rules: 100817 / 100818","detail":"Emergency release 2025-07-21: 100817 (...2168f6f0) for CVE-2025-53770 and 100818 (...8de656c4) for CVE-2025-53771.","logSource":"Cloudflare Security Events / Firewall events","kind":"vendor-signature","url":"https://developers.cloudflare.com/changelog/post/2025-07-21-emergency/","date":"2025-07-21"},{"title":"F5 attack signature: 200204026","detail":"Microsoft SharePoint ToolPane Remote Code Execution (200204026), references CVE-2025-53770, CVE-2025-53771, CVE-2025-49704 and CVE-2025-49706, last update 2025-07-24.","logSource":"F5 Advanced WAF / Distributed Cloud WAF event logs","kind":"vendor-signature","url":"https://docs.cloud.f5.com/docs-v2/platform/reference/attack-signatures","date":"2025-07-24"},{"title":"Fastly Next-Gen WAF: virtual patch CVE-2025-53770","detail":"Virtual patch CVE-2025-53770 added 2025-07-21.","logSource":"Fastly Next-Gen WAF signal logs","kind":"vendor-signature","url":"https://www.fastly.com/documentation/reference/changes/2025/07/added-virtual-patch-for-cve-2025-53770/","date":"2025-07-21"},{"title":"Fortinet FortiWeb: 1090502408 / 1090502410 / 1090502639","detail":"FortiWeb signatures MS.SharePoint.Insecure.Deserialization.Remote.Code.Execution (1090502408, 1090502410, 2025-07-23) and MS.SharePoint.ToolShell.Remote.Code.Execution (1090502639, 2026-10-22).","logSource":"FortiWeb attack logs","kind":"vendor-signature","url":"https://www.fortiguard.com/outbreak-alert/microsoft-sharepoint-zero-day","date":"2026-10-23","dateKind":"checked"},{"title":"Imperva Cloud WAF / WAF Gateway: ToolShell rules","detail":"Imperva states dedicated WAF rules detect and block CVE-2025-53770 deserialization payloads and web shells. No rule IDs published.","logSource":"WAF event logs","kind":"vendor-signature","url":"https://www.imperva.com/blog/imperva-customers-protected-against-critical-toolshell-zero%E2%80%91day-in-microsoft-sharepoint/","date":"2025-07-23"},{"title":"Check Point IPS: CPAI-2025-0570","detail":"Protection 'Microsoft SharePoint Server Insecure Deserialization' covering CVE-2025-49704 and CVE-2025-53770, published 2025-07-21.","logSource":"Check Point IPS logs (SmartConsole / Logs & Monitor)","kind":"vendor-signature","url":"https://advisories.checkpoint.com/defense/advisories/public/2025/cpai-2025-0570.html/","date":"2025-07-21"},{"title":"Cisco Talos Snort: 1:65092, 1:65183","detail":"SID 65092 (released 2025-07-08 for CVE-2025-49704) also detects CVE-2025-53770/53771 per Talos. SID 65183 covers the ToolShell webshell deployment.","logSource":"Snort / Cisco Secure Firewall IPS event logs","kind":"vendor-signature","url":"https://www.snort.org/advisories/talos-rules-2025-07-08","date":"2025-07-08"},{"title":"Fortinet FortiGuard IPS: 58317","detail":"IPS signature MS.SharePoint.ToolShell.Remote.Code.Execution (58317), dated 2025-07-08, references all four ToolShell CVEs.","logSource":"FortiGate IPS logs","kind":"vendor-signature","url":"https://www.fortiguard.com/search?q=CVE-2025-53770&engine=1","date":"2025-07-23"},{"title":"Juniper IDP: HTTP:CTS:CVE-2025-49704RCE, HTTP:CTS:MS-SHRPNT-AUTH-BYPASS","detail":"HTTP:CTS:CVE-2025-49704RCE references CVE-2025-49704 and CVE-2025-53770 (release 2025-07-08). HTTP:CTS:MS-SHRPNT-AUTH-BYPASS references CVE-2025-53771 (release 2025-10-28).","logSource":"Juniper SRX IDP logs","kind":"vendor-signature","url":"https://www.juniper.net/us/en/threatlabs/ips-signatures/detail.HTTP:CTS:CVE-2025-49704RCE.html","date":"2025-07-08"},{"title":"Palo Alto Networks Threat Prevention: 96481 / 96436 / 96496","detail":"Threat IDs 96481, 96436 and 96496 for the SharePoint ToolShell CVEs per Unit 42.","logSource":"Palo Alto Networks threat logs (Threat Prevention / NGFW)","kind":"vendor-signature","url":"https://unit42.paloaltonetworks.com/microsoft-sharepoint-cve-2025-49704-cve-2025-49706-cve-2025-53770/","date":"2025-07-31"},{"title":"Sophos Firewall IPS: SharePoint ExcelDataSet / SignOut signatures","detail":"IPS release 18.23.58 (2025-07-10) lists a SharePoint RCE signature for CVE-2025-49704. Release 18.23.76 (2025-08-21) lists ExcelDataSet CVE-2025-53770 and SignOut Referer CVE-2025-53771 signatures. No SIDs in the notes.","logSource":"Sophos Firewall IPS logs","kind":"vendor-signature","url":"https://docs.sophos.com/releasenotes/output/en-us/nsg/IPSReleaseNotes/18.23.58.html","date":"2025-07-10"},{"title":"Trend Micro TippingPoint 45905 / 45906 / 46160, Deep Security 1012390","detail":"TippingPoint 45905 and 45906 cover CVE-2025-49704/53770 (protection since 2025-05-20); 46160 and Deep Security 1012390 cover CVE-2025-49706/53771.","logSource":"Trend Micro Deep Security / TippingPoint SMS event logs","kind":"vendor-signature","url":"https://success.trendmicro.com/en-US/solution/KA-0020403","date":"2026-10-23","dateKind":"checked"},{"title":"Cato IPS: CVE-2025-53770 / CVE-2025-49704 virtual patch","detail":"Cato IPS virtual patch. Opt-in protection 2025-07-20, global protection 2025-07-21. No rule ID published.","logSource":"Cato Networks IPS events","kind":"vendor-signature","url":"https://www.catonetworks.com/rapid-cve-mitigation/","date":"2026-10-23","dateKind":"checked"},{"title":"Netskope IPS: ET 2063647","detail":"Netskope Threat Labs IPS library lists ET EXPLOIT Microsoft SharePoint ToolPane Authentication Bypass (CVE-2025-49706), SID 2063647. Library pages are undated.","logSource":"Netskope Cloud Firewall / IPS alert logs","kind":"vendor-signature","url":"https://threatlabs.netskope.com/library/ips/et-exploit-microsoft-sharepoint-toolpane-authentication-bypass-cve-2025-49706/","date":"2026-10-23","dateKind":"checked"},{"title":"Zscaler ATP: HTML.Exploit.CVE-2025-49704 / HTML.Exploit.CVE-2025-53770, ZPA 6000294 / 6000295","detail":"ATP signatures HTML.Exploit.CVE-2025-49704, HTML.Exploit.CVE-2025-53770 and ASP/Webshell.AY. ZPA AppProtection rules 6000294 and 6000295.","logSource":"Zscaler ZIA web / threat logs; ZPA AppProtection logs","kind":"vendor-signature","url":"https://www.zscaler.com/blogs/security-research/cve-2025-53770-zero-day-exploit-impacts-microsoft-sharepoint-services","date":"2025-07-21"}],"detectionRules":[{"id":"sigma-toolshell-iis-web","title":"SharePoint ToolShell CVE-2025-53770 Exploitation - Web IIS","language":"sigma","query":"title: SharePoint ToolShell CVE-2025-53770 Exploitation - Web IIS\nid: 48d053db-6a56-4866-b60d-0975647050ed\nstatus: experimental\ndescription: |\n    Detects access to vulnerable SharePoint components potentially being exploited in CVE-2025-53770 through IIS web server logs.\n    CVE-2025-53770 is a zero-day vulnerability in SharePoint that allows remote code execution.\nreferences:\n    - https://www.linkedin.com/posts/mauricefielenbach_sharepoint-incidentresponse-windowssecurity-activity-7352653907363303425-bL2f\n    - https://research.eye.security/sharepoint-under-siege/\n    - https://msrc.microsoft.com/blog/2025/07/customer-guidance-for-sharepoint-vulnerability-cve-2025-53770/\nauthor: Swachchhanda Shrawan Poudel (Nextron Systems)\ndate: 2025-07-21\ntags:\n    - attack.initial-access\n    - attack.t1190\n    - cve.2025-53770\n    - detection.emerging-threats\nlogsource:\n    category: webserver # IIS web server logs\ndetection:\n    selection_exploit_post:\n        cs-method: 'POST'\n        cs-uri-stem|contains: '/_layouts/15/ToolPane.aspx'\n        cs-uri-query|contains: 'DisplayMode=Edit&a=/ToolPane.aspx'\n    selection_exploit_get:\n        cs-method: 'GET'\n        cs-uri-stem|contains: '/_layouts/15/spinstall0.aspx'\n    selection_referer:\n        cs-referer|contains: '/_layouts/SignOut.aspx'\n    condition: 1 of selection_exploit_* and selection_referer\nfalsepositives:\n    - Unknown\nlevel: medium","logSource":"IIS W3C logs","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","authorUrl":"https://github.com/SigmaHQ/sigma","sourceUrl":"https://github.com/SigmaHQ/sigma/blob/05d1031f537e830b76da53bae2400c5814c89165/rules-emerging-threats/2025/Exploits/CVE-2025-53770/web_win_iis_exploit_cve_2025_53770.yml","sourceDate":"2025-07-21","license":"DRL-1.1","origin":"community","tested":"untested"},{"id":"sigma-toolshell-file-create","title":"Potential SharePoint ToolShell CVE-2025-53770 Exploitation - File Create","language":"sigma","query":"title: Potential SharePoint ToolShell CVE-2025-53770 Exploitation - File Create\nid: ba479447-721f-42a9-9af2-6dcd517bbdb3\nstatus: experimental\ndescription: |\n    Detects the creation of file such as spinstall0.aspx which may indicate successful exploitation of CVE-2025-53770.\n    CVE-2025-53770 is a zero-day vulnerability in SharePoint that allows remote code execution.\nreferences:\n    - https://research.eye.security/sharepoint-under-siege/\n    - https://msrc.microsoft.com/blog/2025/07/customer-guidance-for-sharepoint-vulnerability-cve-2025-53770/\n    - https://unit42.paloaltonetworks.com/microsoft-sharepoint-cve-2025-49704-cve-2025-49706-cve-2025-53770/\nauthor: Swachchhanda Shrawan Poudel (Nextron Systems)\ndate: 2025-07-21\nmodified: 2025-07-24\ntags:\n    - attack.initial-access\n    - attack.t1190\n    - cve.2025-53770\n    - detection.emerging-threats\nlogsource:\n    product: windows\n    category: file_event\ndetection:\n    selection:\n        TargetFilename|startswith:\n            - 'C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\'\n            - 'C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\Web Server Extensions\\'\n        TargetFilename|contains:\n            - '\\15\\TEMPLATE\\LAYOUTS\\'\n            - '\\16\\TEMPLATE\\LAYOUTS\\'\n        TargetFilename|endswith:\n            - '\\spinstall.aspx'\n            - '\\spinstall?.aspx'\n            - '\\debug_dev.js'\n    condition: selection\nfalsepositives:\n    - Unknown\nlevel: critical","logSource":"Windows file creation (Sysmon 11)","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","authorUrl":"https://github.com/SigmaHQ/sigma","sourceUrl":"https://github.com/SigmaHQ/sigma/blob/05d1031f537e830b76da53bae2400c5814c89165/rules-emerging-threats/2025/Exploits/CVE-2025-53770/file_event_win_exploit_cve_2025_53770.yml","sourceDate":"2025-07-24","license":"DRL-1.1","origin":"community","tested":"untested"},{"id":"splunk-sharepoint-toolpane-post","title":"Windows SharePoint ToolPane Endpoint Exploitation Attempt","language":"spl","query":"| tstats count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Web\n  WHERE Web.url=\"*/_layouts/15/ToolPane.aspx*\"\n    AND\n    Web.url=\"*DisplayMode=Edit*\" Web.http_method=POST\n  BY Web.http_user_agent, Web.status, Web.http_method,\n     Web.url, Web.url_length, Web.src,\n     Web.dest, sourcetype\n| `drop_dm_object_name(\"Web\")`\n| `security_content_ctime(firstTime)`\n| `security_content_ctime(lastTime)`\n| `windows_sharepoint_toolpane_endpoint_exploitation_attempt_filter`","logSource":"Web data model (Suricata, IIS or proxy logs)","author":"Michael Haag, Splunk","authorUrl":"https://research.splunk.com/","sourceUrl":"https://github.com/splunk/security_content/blob/7aafb1e3bc6bbe2b49bcf7d4fed029a5ea7e871c/detections/web/windows_sharepoint_toolpane_endpoint_exploitation_attempt.yml","sourceDate":"2026-05-13","license":"Apache-2.0","origin":"vendor","notes":"Uses Splunk ES macros and data models from splunk/security_content; the trailing _filter macro is a tuning hook.","tested":"tested","testedNote":"Splunk security_content YAML includes a True Positive Test and status production.","testedSourceUrl":"https://github.com/splunk/security_content/blob/7aafb1e3bc6bbe2b49bcf7d4fed029a5ea7e871c/detections/web/windows_sharepoint_toolpane_endpoint_exploitation_attempt.yml"},{"id":"splunk-sharepoint-spinstall0-file","title":"Windows SharePoint Spinstall0 Webshell File Creation","language":"spl","query":"| tstats count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem where Filesystem.file_name=\"spinstall0.aspx\" AND (Filesystem.file_path=\"*\\\\microsoft shared\\\\Web Server Extensions\\\\16\\\\TEMPLATE\\\\LAYOUTS*\" OR Filesystem.file_path=\"*\\\\microsoft shared\\\\Web Server Extensions\\\\15\\\\TEMPLATE\\\\LAYOUTS*\") by Filesystem.dest Filesystem.user Filesystem.file_create_time Filesystem.file_name Filesystem.file_path Filesystem.action Filesystem.process_guid Filesystem.process_id Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_sharepoint_spinstall0_webshell_file_creation_filter`","logSource":"Sysmon EventID 11 (Endpoint.Filesystem data model)","author":"Michael Haag, Splunk","authorUrl":"https://research.splunk.com/","sourceUrl":"https://github.com/splunk/security_content/blob/7aafb1e3bc6bbe2b49bcf7d4fed029a5ea7e871c/detections/endpoint/windows_sharepoint_spinstall0_webshell_file_creation.yml","sourceDate":"2026-05-13","license":"Apache-2.0","origin":"vendor","notes":"Uses Splunk ES macros and data models from splunk/security_content; the trailing _filter macro is a tuning hook.","tested":"tested","testedNote":"Splunk security_content YAML includes a True Positive Test and status production.","testedSourceUrl":"https://github.com/splunk/security_content/blob/7aafb1e3bc6bbe2b49bcf7d4fed029a5ea7e871c/detections/endpoint/windows_sharepoint_spinstall0_webshell_file_creation.yml"},{"id":"ms-toolshell-spinstall-file-creation","title":"Successful exploitation using file creation (spinstall0.aspx)","language":"kql","query":"DeviceFileEvents \n| where FolderPath has_any (\"microsoft shared\\\\Web Server Extensions\\\\15\\\\TEMPLATE\\\\LAYOUTS\", \"microsoft shared\\\\Web Server Extensions\\\\16\\\\TEMPLATE\\\\LAYOUTS\") \n| where FileName contains \"spinstall\" or FileName contains \"spupdate\" or FileName contains \"SpLogoutLayout\" or FileName contains \"SP.UI.TitleView\" \nor FileName contains \"queryruleaddtool\" or FileName contains \"ClientId\"\n| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, FolderPath, ReportId, ActionType, SHA256 \n| order by Timestamp desc","logSource":"Microsoft Defender for Endpoint DeviceFileEvents","author":"Microsoft Threat Intelligence","authorUrl":"https://www.microsoft.com/en-us/security/blog/","sourceUrl":"https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/","sourceDate":"2025-07-23","license":"Posted publicly; see source","origin":"vendor","notes":"Copied from the blog's Defender XDR hunting section (updated 23 Jul 2025).","tested":"untested"},{"id":"logscale-toolshell-w3wp-cmd-pwsh-aspx","title":"CVE-2025-53770 - WebShell Discovery from w3wp.exe","language":"logscale","query":"// CVE-2025-53770 - WebShell Discovery from w3wp.exe\n\ncorrelate(\n    cmd: {\n        #event_simpleName=ProcessRollup2 event_platform=Win FileName=\"cmd.exe\" ParentBaseFileName=\"w3wp.exe\"\n          } include: [aid, ComputerName, TargetProcessId, ParentBaseFileName, FileName, CommandLine],\n    pwsh: {\n        #event_simpleName=ProcessRollup2 event_platform=Win FileName=\"powershell.exe\"\n          | aid <=> cmd.aid\n          | ParentProcessId <=> cmd.TargetProcessId\n          } include: [aid, ComputerName, TargetProcessId, ParentBaseFileName, FileName, CommandLine],\n    aspx: {\n        #event_simpleName=/^(NewScriptWritten|WebScriptFileWritten)$/ event_platform=Win FileName=/\\.aspx/i\n          | aid <=> cmd.aid\n          | ContextProcessId <=> pwsh.TargetProcessId\n          } include: [aid, ComputerName, TargetFileName],\nsequence=true, within=5m)","logSource":"CrowdStrike Falcon ProcessRollup2, NewScriptWritten / WebScriptFileWritten (Windows)","author":"CrowdStrike LogScale community content","authorUrl":"https://github.com/CrowdStrike/logscale-community-content","sourceUrl":"https://github.com/CrowdStrike/logscale-community-content/blob/0152b8a763e34991461b9e8f8dd5036b596ba08f/Queries-Only/Helpful-CQL-Queries/CVE-2025-53770%20-%20SharePoint%20ToolShell.md","sourceDate":"2025-07-22","license":"Unlicense","origin":"community","notes":"Sequence w3wp.exe to cmd.exe to powershell.exe to .aspx write within 5 minutes.","tested":"untested"},{"id":"et-sharepoint-toolpane-auth-bypass","title":"ET EXPLOIT Microsoft SharePoint ToolPane Authentication Bypass (CVE-2025-49706)","language":"suricata","query":"alert http any any -> $HOME_NET any (msg:\"ET EXPLOIT Microsoft SharePoint ToolPane Authentication Bypass (CVE-2025-49706)\"; flow:established,to_server; http.method; content:\"POST\"; http.uri; content:\"|2f|toolpane.aspx|3f|\"; fast_pattern; nocase; content:\"displaymode|3d|edit\"; nocase; content:\"|2f|toolpane.aspx\"; endswith; nocase; http.referer; content:\"|2f|signout.aspx\"; nocase; http.request_body; content:\"msotlpn_uri|3d|\"; nocase; pcre:\"/^.*?(?:\\x252[fF]|\\x2f)_controltemplates(?:\\x252[fF]|\\x2f).*?(?:\\x252[eE]|\\x2e)ascx(?:\\x26|$)/R\"; content:\"msotlpn_dwp|3d|\"; nocase; reference:url,msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49706; reference:cve,2025-49706; classtype:attempted-user; sid:2063647; rev:1; metadata:affected_product Microsoft_Sharepoint, attack_target Server, tls_state TLSDecrypt, created_at 2025_07_08, cve CVE_2025_49706, deployment Perimeter, deployment Internal, confidence Medium, signature_severity Major, tag Exploit, tag CISA_KEV, updated_at 2025_07_22, former_sid 2863405, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application; target:dest_ip;)","logSource":"Suricata IDS alerts (ET Open ruleset)","author":"Emerging Threats (Proofpoint)","authorUrl":"https://rules.emergingthreats.net/","sourceUrl":"https://rules.emergingthreats.net/open/suricata-7.0.3/rules/emerging-exploit.rules","sourceDate":"2025-07-22","license":"BSD-3-Clause (ET Open, sids 2000000-2799999)","origin":"vendor","notes":"Needs decrypted HTTP to SharePoint.","tested":"untested"},{"id":"yara-toolshell-aspx-webshell","title":"WEBSHELL_ASPX_Sharepoint_Drop_CVE_2025_53770_Jul25","language":"yara","query":"rule WEBSHELL_ASPX_Sharepoint_Drop_CVE_2025_53770_Jul25 {\n   meta:\n      description = \"Detects ASPX web shell dropped during the exploitation of SharePoint RCE vulnerability CVE-2025-53770\"\n      author = \"Florian Roth\"\n      reference = \"https://research.eye.security/sharepoint-under-siege/\"\n      date = \"2025-07-20\"\n      score = 80\n      hash = \"27c45b8ed7b8a7e5fff473b50c24028bd028a9fe8e25e5cea2bf5e676e531014\"\n      hash = \"92bb4ddb98eeaf11fc15bb32e71d0a63256a0ed826a03ba293ce3a8bf057a514\"\n      hash = \"b336f936be13b3d01a8544ea3906193608022b40c28dd8f1f281e361c9b64e93\"\n      id = \"f1c8f671-a0d2-5aaf-93f4-025dace0dbe1\"\n   strings:\n      $x1 = \"var sy = System.Reflection.Assembly.Load(\" ascii\n      $x2 = \"Response.Write(cg.ValidationKey+\" ascii\n\n      $s1 = \"<script runat=\\\"server\\\" language=\\\"c#\\\" CODEPAGE=\\\"65001\\\">\" ascii fullword\n   condition:\n      filesize < 4KB\n      and 1 of ($x*)\n      or all of them\n}","logSource":"Files under SharePoint LAYOUTS directories (YARA scan)","author":"Florian Roth","authorUrl":"https://github.com/Neo23x0/signature-base","sourceUrl":"https://github.com/Neo23x0/signature-base/blob/3ce6640c26046da8e6d8094af3eaaee3ee84e648/yara/expl_sharepoint_jul25.yar","sourceDate":"2025-07-20","license":"DRL-1.1","origin":"community","tested":"untested"}],"detectionLinks":[{"title":"Microsoft: Disrupting active exploitation of on-premises SharePoint vulnerabilities","url":"https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/","author":"Microsoft Threat Intelligence","date":"2025-07-23","note":"More Defender XDR and ASIM queries (encoded PowerShell from w3wp.exe, alert evidence, IOC sweeps)."},{"title":"Elastic: Potential ToolShell Initial Exploit","url":"https://github.com/elastic/detection-rules/blob/1b18e9c958f104a3cb049c565a216436deba272f/rules_building_block/initial_access_potential_toolshell_exploit_attempt.toml","author":"Elastic","date":"2026-10-06","note":"kuery building block, linked only."},{"title":"Elastic: Potential VIEWSTATE RCE Attempt on SharePoint/IIS","url":"https://github.com/elastic/detection-rules/blob/1b18e9c958f104a3cb049c565a216436deba272f/rules_building_block/initial_access_potential_rce_via_toolshell.toml","author":"Elastic","date":"2026-10-06","note":"kuery building block, linked only."},{"title":"Splunk: Windows SharePoint Spinstall0 GET Request","url":"https://github.com/splunk/security_content/blob/7aafb1e3bc6bbe2b49bcf7d4fed029a5ea7e871c/detections/web/windows_sharepoint_spinstall0_get_request.yml","author":"Splunk Threat Research Team"},{"title":"SigmaHQ: Suspicious File Write to SharePoint Layouts Directory","url":"https://github.com/SigmaHQ/sigma/blob/05d1031f537e830b76da53bae2400c5814c89165/rules/windows/file/file_event/file_event_win_susp_filewrite_in_sharepoint_layouts_dir.yml","author":"Swachchhanda Shrawan Poudel","date":"2025-07-24"},{"title":"Eye Security: SharePoint under siege","url":"https://research.eye.security/sharepoint-under-siege/","author":"Eye Security","date":"2025-07-18"}],"retrohunt":{"summary":"Search IIS logs back to 7 Jul 2025 for POSTs to ToolPane.aspx with a SignOut.aspx Referer, then hunt for spinstall0.aspx and for w3wp.exe spawning shells.","lookback":{"from":"2025-07-07","basis":"first-attempt","rationale":"Microsoft assesses earliest exploitation attempts against CVE-2025-49706 and CVE-2025-49704 as early as 7 Jul 2025. Eye Security saw large-scale ToolShell exploitation on the evening of 18 Jul 2025. Stolen ASP.NET machine keys survive webshell cleanup, so keep searching after cleanup.","sources":[{"url":"https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/","date":"2025-07-22","publisher":"Microsoft"},{"url":"https://research.eye.security/sharepoint-under-siege/","date":"2025-07-18","publisher":"Eye Security"}]},"logSources":[{"name":"IIS W3C logs on SharePoint servers","why":"Show ToolPane POSTs and webshell GETs.","required":true},{"name":"Microsoft Defender for Endpoint DeviceFileEvents","why":"Shows spinstall0.aspx and related files written under LAYOUTS.","required":true},{"name":"DeviceProcessEvents for w3wp.exe","why":"Shows post-exploitation commands.","required":true},{"name":"Network logs for the Microsoft IOC IPs","why":"Microsoft published IPs used in ToolShell activity.","required":false}],"steps":[{"title":"Search IIS logs for ToolPane POSTs","detail":"Eye Security and Microsoft highlight POSTs to /_layouts/15/ToolPane.aspx (DisplayMode=Edit) with Referer /_layouts/SignOut.aspx.","sources":[{"url":"https://research.eye.security/sharepoint-under-siege/","date":"2025-07-18","publisher":"Eye Security"},{"url":"https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/","date":"2025-07-22","publisher":"Microsoft"}]},{"title":"Search for the webshell","detail":"Look for spinstall0.aspx and renamed variants under LAYOUTS paths. Microsoft saw it used to return MachineKey material.","sources":[{"url":"https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/","date":"2025-07-22","publisher":"Microsoft"}]},{"title":"Hunt w3wp.exe children","detail":"Microsoft describes command execution through the SharePoint worker process, then discovery and ransomware staging.","sources":[{"url":"https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/","date":"2025-07-22","publisher":"Microsoft"}]},{"title":"Search network logs for Microsoft's IOC IPs","detail":"Microsoft's advanced hunting sample includes 131.226.2.6, 134.199.202.205, 104.238.159.149 and 188.130.206.168.","sources":[{"url":"https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/","date":"2025-07-22","publisher":"Microsoft"}]}],"queries":[{"id":"v2s-rh-kql-toolshell-toolpane","title":"ToolPane POSTs with SignOut Referer since 7 Jul 2025","language":"kql","query":"W3CIISLog\n| where TimeGenerated >= datetime(2025-07-07)\n| where csMethod == \"POST\" and csUriStem has \"ToolPane.aspx\"\n| where csUriQuery has \"DisplayMode=Edit\" or isnotempty(csUriQuery)\n| where csReferer has \"SignOut.aspx\"\n| summarize Count = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by cIP, csUriStem, scStatus","logSource":"IIS W3C logs in Microsoft Sentinel (W3CIISLog)","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://research.eye.security/sharepoint-under-siege/","sourceDate":"2025-07-18","license":"CC0 1.0","origin":"vuln2shell","notes":"csReferer must be logged. Adjust if your IIS field names differ.","tested":"untested","timeRange":"From 2025-07-07, limited by retention"},{"id":"v2s-rh-kql-toolshell-spinstall","title":"spinstall webshell file creates since 7 Jul 2025","language":"kql","query":"DeviceFileEvents\n| where Timestamp >= datetime(2025-07-07)\n| where FileName startswith \"spinstall\" and FileName endswith \".aspx\"\n| where FolderPath has \"LAYOUTS\"\n| project Timestamp, DeviceName, FolderPath, FileName, SHA256, InitiatingProcessFileName","logSource":"Microsoft Defender for Endpoint DeviceFileEvents","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/","sourceDate":"2025-07-22","license":"CC0 1.0","origin":"vuln2shell","tested":"untested","timeRange":"From 2025-07-07, limited by retention"},{"id":"v2s-rh-kql-toolshell-ioc-ips","title":"Microsoft ToolShell IOC IPs since 7 Jul 2025","language":"kql","query":"let ioc_ip_addr = dynamic([\"131.226.2.6\", \"134.199.202.205\", \"104.238.159.149\", \"188.130.206.168\"]);\n_Im_NetworkSession(starttime=datetime(2025-07-07))\n| where DstIpAddr in (ioc_ip_addr)\n| summarize Count = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SrcIpAddr, DstIpAddr, Dvc","logSource":"Microsoft Sentinel ASIM NetworkSession","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/","sourceDate":"2025-07-22","license":"CC0 1.0","origin":"vuln2shell","notes":"IPs from Microsoft's advanced hunting sample.","tested":"untested","timeRange":"From 2025-07-07"},{"id":"v2s-rh-spl-toolshell-toolpane","title":"ToolPane POSTs with SignOut Referer since 7 Jul 2025","language":"spl","query":"index=* sourcetype=ms:iis:* earliest=\"07/07/2025:00:00:00\"\ncs_method=POST cs_uri_stem=\"*ToolPane.aspx*\" cs_Referer=\"*SignOut.aspx*\"\n| stats count min(_time) as firstTime max(_time) as lastTime by c_ip, cs_uri_stem, sc_status\n| convert ctime(firstTime) ctime(lastTime)","logSource":"IIS logs in Splunk","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://research.eye.security/sharepoint-under-siege/","sourceDate":"2025-07-18","license":"CC0 1.0","origin":"vuln2shell","tested":"untested","timeRange":"From 2025-07-07"}],"thirdPartyQueries":[{"title":"Microsoft advanced hunting for ToolShell","url":"https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/","author":"Microsoft","date":"2025-07-22","language":"kql","license":"see source","origin":"vendor","note":"Includes file, process and network hunts."},{"title":"CrowdStrike LogScale ToolShell queries","url":"https://github.com/CrowdStrike/logscale-community-content/blob/0152b8a763e34991461b9e8f8dd5036b596ba08f/Queries-Only/Helpful-CQL-Queries/CVE-2025-53770%20-%20SharePoint%20ToolShell.md","author":"CrowdStrike community","date":null,"language":"logscale","license":"see source","origin":"vendor","note":"Already linked from Detection."}],"artefacts":[{"kind":"web-log","value":"POST /_layouts/15/ToolPane.aspx?DisplayMode=Edit with Referer /_layouts/SignOut.aspx","detail":"Observed exploit request.","sourceUrl":"https://research.eye.security/sharepoint-under-siege/","sourceDate":"2025-07-18"},{"kind":"file","value":"spinstall0.aspx (and renamed variants) under LAYOUTS","detail":"Webshell used to steal MachineKey.","sourceUrl":"https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/","sourceDate":"2025-07-22"},{"kind":"process","value":"w3wp.exe spawning cmd.exe, powershell.exe or discovery tools","detail":"Post-exploitation.","sourceUrl":"https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/","sourceDate":"2025-07-22"}],"iocs":[{"type":"ip","value":"131.226.2[.]6","context":"Listed in Microsoft advanced hunting sample.","sourceUrl":"https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/","sourceDate":"2025-07-22"},{"type":"ip","value":"134.199.202[.]205","context":"Listed in Microsoft advanced hunting sample.","sourceUrl":"https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/","sourceDate":"2025-07-22"},{"type":"ip","value":"104.238.159[.]149","context":"Listed in Microsoft advanced hunting sample.","sourceUrl":"https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/","sourceDate":"2025-07-22"},{"type":"ip","value":"188.130.206[.]168","context":"Listed in Microsoft advanced hunting sample.","sourceUrl":"https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/","sourceDate":"2025-07-22"},{"type":"filename","value":"spinstall0.aspx","context":"Webshell name from Microsoft.","sourceUrl":"https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/","sourceDate":"2025-07-22"}],"hitMeaning":[{"level":"attempt","detail":"A ToolPane POST with SignOut Referer and no webshell."},{"level":"likely-compromise","detail":"spinstall0.aspx on disk or requested with a 200."},{"level":"confirmed-compromise","detail":"MachineKey theft or w3wp.exe post-exploitation. Rotate machine keys even after webshell removal."}],"nextSteps":[{"title":"Patch, rotate machine keys, restart IIS","detail":"Microsoft says stolen keys survive webshell cleanup.","links":[{"label":"Microsoft guidance","href":"https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/"}]},{"title":"Hunt connected systems","detail":"Review GPO changes and ransomware staging Microsoft describes for Storm-2603."}],"limits":["Referer is not always logged.","Renamed webshells will miss a filename-only hunt."],"sources":[{"url":"https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/","date":"2025-07-22","publisher":"Microsoft"},{"url":"https://research.eye.security/sharepoint-under-siege/","date":"2025-07-18","publisher":"Eye Security"}],"updatedAt":"2026-10-24"},"amIAffected":{"summary":"On-premises SharePoint Server 2016, 2019, and Subscription Edition are in scope until the July 2025 KBs listed on the page are installed. Microsoft states SharePoint Online in Microsoft 365 is not affected. Treat internet-facing on-prem farms as exposed until version, AMSI Full Mode, and those KBs are confirmed.","checks":[{"id":"v2s-aia-toolshell-version-1","kind":"version","title":"Confirm on-prem SharePoint product and July 2025 security KBs","detail":"Microsoft first-fixed updates: Subscription Edition KB5002768; SharePoint 2019 KB5002754 plus language pack KB5002753; SharePoint 2016 KB5002760 plus language pack KB5002759. SharePoint security updates are cumulative. Both 2016/2019 updates listed should be applied. Use SharePoint Management Shell plus Central Admin Check product and patch installation status. (Get-SPFarm).BuildVersion is a farm schema version and does not always prove a specific KB is present.","command":"Add-PSSnapin Microsoft.SharePoint.PowerShell -ErrorAction SilentlyContinue; (Get-SPFarm).BuildVersion; Get-HotFix | Where-Object { $_.HotFixID -in 'KB5002768','KB5002754','KB5002753','KB5002760','KB5002759' } | Format-Table HotFixID, InstalledOn, InstalledBy","affectedMeans":"Supported on-prem SharePoint 2016, 2019, or Subscription Edition without the matching July 2025 KB(s). Unsupported on-prem trains (CISA names SharePoint Server 2013 and earlier as end of life) remain internet-risky; do not label them not affected.","fixedMeans":"KB5002768 on Subscription Edition; KB5002754 and KB5002753 on 2019; KB5002760 and KB5002759 on 2016. Then rotate machine keys and restart IIS as Microsoft requires after the update.","notes":"Microsoft Defender Vulnerability Management can list devices still tagged with CVE-2025-49704, CVE-2025-49706, CVE-2025-53770, or CVE-2025-53771.","sources":[{"url":"https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/","date":"2025-07-22","publisher":"Microsoft"},{"url":"https://www.microsoft.com/en-us/msrc/blog/2025/07/customer-guidance-for-sharepoint-vulnerability-cve-2025-53770","date":"2025-07-19","publisher":"Microsoft MSRC"},{"url":"https://learn.microsoft.com/en-us/powershell/module/microsoft.sharepoint.powershell/get-spfarm?view=sharepoint-ps","date":"2026-10-24","publisher":"Microsoft Learn (cmdlet reference; checked)"}]},{"id":"v2s-aia-toolshell-package-2","kind":"package","title":"Defender TVM software-vulnerability inventory","detail":"Microsoft published this read-only hunt to list devices still mapped to the ToolShell CVE set.","command":"DeviceTvmSoftwareVulnerabilities | where CveId in (\"CVE-2025-49704\",\"CVE-2025-49706\",\"CVE-2025-53770\",\"CVE-2025-53771\")","affectedMeans":"A row for any of those CVE IDs means Defender still assesses that device as exposed to the named CVE.","fixedMeans":"No rows for those CVE IDs after the July 2025 SharePoint KBs are installed and TVM has refreshed.","sources":[{"url":"https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/","date":"2025-07-22","publisher":"Microsoft"},{"url":"https://www.microsoft.com/en-us/msrc/blog/2025/07/customer-guidance-for-sharepoint-vulnerability-cve-2025-53770","date":"2025-07-19","publisher":"Microsoft MSRC"}]},{"id":"v2s-aia-toolshell-config-3","kind":"config","title":"AMSI integration and Full Mode body scan","detail":"Microsoft says enabling AMSI with Microsoft Defender Antivirus or equivalent, in Full Mode, helps stop unauthenticated attacks. AMSI integration was enabled by default in the September 2023 security update for SharePoint Server 2016/2019 and the Version 23H2 feature update for Subscription Edition. Microsoft Learn documents feature GUID 4cf046f3-38c7-495f-a7da-a1292d32e8e9 and AMSIBodyScanMode values: 0 Off, 1 Balanced, 2 Full. Inventory the setting only.","command":"Add-PSSnapin Microsoft.SharePoint.PowerShell -ErrorAction SilentlyContinue; Get-SPWebApplication | ForEach-Object { $feat = Get-SPFeature -Identity 4cf046f3-38c7-495f-a7da-a1292d32e8e9 -WebApplication $_.Url -ErrorAction SilentlyContinue; [PSCustomObject]@{ Url = $_.Url; AmsiFeaturePresent = [bool]$feat; AMSIBodyScanMode = $_.AMSIBodyScanMode } }","affectedMeans":"AMSI feature missing or AMSIBodyScanMode not 2 (Full) on an internet-reachable on-prem web app, especially before the July 2025 KBs. Microsoft: if AMSI cannot be enabled, treat the server as needing isolation until patched.","fixedMeans":"AMSI feature present and AMSIBodyScanMode 2 (Full) on each web app, plus a compatible AMSI antivirus on every SharePoint server, plus the July 2025 KBs.","notes":"Microsoft Learn: body scanning cannot be enabled without header scanning. Each web application is configured independently. Central Admin for Subscription Edition 25H1+: Security, AMSI Configuration.","sources":[{"url":"https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/","date":"2025-07-22","publisher":"Microsoft"},{"url":"https://www.microsoft.com/en-us/msrc/blog/2025/07/customer-guidance-for-sharepoint-vulnerability-cve-2025-53770","date":"2025-07-19","publisher":"Microsoft MSRC"},{"url":"https://learn.microsoft.com/en-us/sharepoint/security-for-sharepoint-server/configure-amsi-integration","date":"2026-10-24","publisher":"Microsoft Learn (checked)"}]},{"id":"v2s-aia-toolshell-exposure-4","kind":"exposure","title":"Internet-facing on-prem SharePoint in your ranges","detail":"Censys and Shodan product queries used on the catalog page. Scope every query to your ranges. A hit is exposure, not proof of the CVE.","command":"shodan search '\"MicrosoftSharePointTeamServices\" net:<your-range>'","affectedMeans":"An on-prem MicrosoftSharePointTeamServices banner in your net or org that has not been confirmed patched with the July 2025 KBs.","fixedMeans":"No internet-facing on-prem SharePoint in your ranges, or every hit is confirmed on the July 2025 KBs and isolated from unauthenticated traffic.","notes":"Catalog Shodan snapshot 2026-10-23 used query MicrosoftSharePointTeamServices. Censys 2025-07-21 and 2025-08-03 counts are global.","sources":[{"url":"https://www.shodan.io/search?query=%22MicrosoftSharePointTeamServices%22","date":"2026-10-23","publisher":"Shodan (catalog snapshot)"},{"url":"https://censys.com/advisory/cve-2025-53770/","date":"2025-07-21","publisher":"Censys"}]}],"limits":["Farm BuildVersion alone does not prove KB5002768 / KB5002754 / KB5002760 are installed.","SharePoint Online is vendor-stated not affected. Unsupported on-prem versions are not vendor-stated not affected.","AMSI Full Mode is a mitigation, not a substitute for the July 2025 updates.","Internet product banners do not show patch status."],"sources":[{"url":"https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/","date":"2025-07-22","publisher":"Microsoft"},{"url":"https://www.microsoft.com/en-us/msrc/blog/2025/07/customer-guidance-for-sharepoint-vulnerability-cve-2025-53770","date":"2025-07-19","publisher":"Microsoft MSRC"},{"url":"https://learn.microsoft.com/en-us/powershell/module/microsoft.sharepoint.powershell/get-spfarm?view=sharepoint-ps","date":"2026-10-24","publisher":"Microsoft Learn (cmdlet reference; checked)"},{"url":"https://learn.microsoft.com/en-us/sharepoint/security-for-sharepoint-server/configure-amsi-integration","date":"2026-10-24","publisher":"Microsoft Learn (checked)"},{"url":"https://www.shodan.io/search?query=%22MicrosoftSharePointTeamServices%22","date":"2026-10-23","publisher":"Shodan (catalog snapshot)"},{"url":"https://censys.com/advisory/cve-2025-53770/","date":"2025-07-21","publisher":"Censys"}],"updatedAt":"2026-10-24","addedDate":"2026-10-24"},"mitigations":{"summary":"Microsoft documents AMSI Full Mode plus Defender Antivirus as an interim control, and isolation if AMSI cannot be enabled. CISA tells you to disconnect end-of-life public SharePoint. These do not replace the July 2025 KBs or machine-key rotation.","items":[{"title":"Enable AMSI Full Mode and deploy Defender Antivirus or equivalent","detail":"Microsoft: configure AMSI integration in SharePoint, enable Full Mode, and deploy Defender Antivirus on all SharePoint servers to stop unauthenticated attackers from exploiting this vulnerability. AMSI was on by default after the September 2023 2016/2019 security update and Subscription Edition 23H2.","limits":"Not a replacement for the July 2025 KBs. Microsoft still requires machine-key rotation and IIS restart after AMSI or the update. Full Mode body scan availability depends on product train (Microsoft Learn: request body scan for Subscription Edition 25H1+).","verify":"Get-SPWebApplication | ForEach-Object { [PSCustomObject]@{ Url = $_.Url; AMSIBodyScanMode = $_.AMSIBodyScanMode } }  # 2 = Full per Microsoft Learn","source":{"url":"https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/","date":"2025-07-22","publisher":"Microsoft"}},{"title":"If AMSI cannot be enabled, remove unauthenticated internet reachability","detail":"Microsoft: if you cannot enable AMSI, consider disconnecting the server from the internet until the current security update is applied. If it cannot be disconnected, consider a VPN or proxy requiring authentication, or an authentication gateway, to limit unauthenticated traffic. CISA: if AMSI cannot be enabled, disconnect public-facing products from internet service until official mitigations are available.","limits":"Does not remove stolen machine keys or webshells already present. Does not patch the bug.","verify":"Confirm the SharePoint HTTPS listener is not reachable from untrusted networks, then: shodan search '\"MicrosoftSharePointTeamServices\" net:<your-range>'","source":{"url":"https://www.microsoft.com/en-us/msrc/blog/2025/07/customer-guidance-for-sharepoint-vulnerability-cve-2025-53770","date":"2025-07-19","publisher":"Microsoft MSRC"}},{"title":"Disconnect end-of-life public-facing SharePoint","detail":"CISA: disconnect public-facing SharePoint Server that has reached end of life or end of service from the internet. CISA example: SharePoint Server 2013 and earlier.","limits":"This is isolation, not a patch. Do not call those versions not affected.","verify":"Inventory product edition in Central Admin or (Get-SPFarm).BuildVersion; confirm 2013 and earlier have no public 443/80 path.","source":{"url":"https://www.cisa.gov/news-events/alerts/2025/07/20/update-microsoft-releases-guidance-exploitation-sharepoint-vulnerabilities","date":"2025-07-22","publisher":"CISA"}}],"updatedAt":"2026-10-24","addedDate":"2026-10-24"},"response":{"summary":"Isolate the farm, preserve IIS config, rotate ASP.NET machine keys, and hunt ToolPane posts plus spinstall webshells. Stolen machine keys survive webshell cleanup.","containment":[{"title":"Isolate the SharePoint server from untrusted networks","detail":"Eye Security: isolate or shut down affected SharePoint servers. Blocking via firewall is not enough if persistence may already exist. Microsoft: implement the incident response plan after patch, AMSI, and key rotation.","sources":[{"url":"https://research.eye.security/sharepoint-under-siege/","date":"2025-07-19","publisher":"Eye Security"},{"url":"https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/","date":"2025-07-22","publisher":"Microsoft"}]},{"title":"Preserve IIS config before recycle","detail":"CISA: if IIS is restarted without manually removing malicious module entries from applicationHost.config and web.config, malicious modules persist and reload.","sources":[{"url":"https://www.cisa.gov/news-events/alerts/2025/07/20/update-microsoft-releases-guidance-exploitation-sharepoint-vulnerabilities","date":"2025-07-22","publisher":"CISA"}]},{"title":"Take a forensic image before rebuild","detail":"Preserve disk, memory if possible, IIS logs, and the LAYOUTS directory before wiping. Stolen machine keys survive webshell cleanup.","generic":true}],"rotate":[{"item":"SharePoint ASP.NET machine keys (ValidationKey and DecryptionKey)","reason":"Observed attacks steal MachineKey material via spinstall0.aspx and variants. Stolen keys let an attacker keep signing ViewState after the webshell is gone. Microsoft: after the latest security updates or enabling AMSI, rotate keys (Set-SPMachineKey / Update-SPMachineKey or Central Admin Machine Key Rotation Job) then iisreset.exe on all SharePoint servers. CISA: rotate, then after the update rotate again, then restart IIS.","sources":[{"url":"https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/","date":"2025-07-22","publisher":"Microsoft"},{"url":"https://www.microsoft.com/en-us/msrc/blog/2025/07/customer-guidance-for-sharepoint-vulnerability-cve-2025-53770","date":"2025-07-19","publisher":"Microsoft MSRC"},{"url":"https://www.cisa.gov/news-events/alerts/2025/07/20/update-microsoft-releases-guidance-exploitation-sharepoint-vulnerabilities","date":"2025-07-22","publisher":"CISA"}]},{"item":"Credentials and secrets that could have been exposed via the malicious ASPX or LSASS","reason":"Eye Security: renew all credentials and system secrets that could have been exposed via the malicious ASPX. Microsoft observed Storm-2603 using Mimikatz against LSASS and then PsExec / Impacket / GPO.","sources":[{"url":"https://research.eye.security/sharepoint-under-siege/","date":"2025-07-19","publisher":"Eye Security"},{"url":"https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/","date":"2025-07-22","publisher":"Microsoft"}]}],"persistence":[{"kind":"webshell","value":"spinstall0.aspx (also spinstall.aspx, spinstall1.aspx, spinstall2.aspx and other spinstallN names)","detail":"Microsoft: web shell used to retrieve MachineKey data via GET. Eye Security published the decoded ASPX and the 8.3 destination under Web Server Extensions 16 LAYOUTS, plus the 15 equivalent.","sourceUrl":"https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/","sourceDate":"2025-07-22"},{"kind":"path","value":"C:\\PROGRA~1\\COMMON~1\\MICROS~1\\WEBSER~1\\16\\LAYOUTS\\spinstall0.aspx (Eye also lists the 15 hive)","detail":"Eye Security decoded PowerShell that dropped the file in the SharePoint 16 hive LAYOUTS folder. Microsoft hunting looks under microsoft shared\\Web Server Extensions\\15 and \\16 LAYOUTS for names containing spinstall, spupdate, SpLogoutLayout, SP.UI.TitleView, queryruleaddtool, or ClientId.","sourceUrl":"https://research.eye.security/sharepoint-under-siege/","sourceDate":"2025-07-19"},{"kind":"path","value":"debug_dev.js under Web Server Extensions 15 or 16 LAYOUTS","detail":"Microsoft IOC table: file containing web config data, including MachineKey data. Path written under the 15 or 16 hive LAYOUTS as debug_dev.js.","sourceUrl":"https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/","sourceDate":"2025-07-22"},{"kind":"path","value":"IIS_Server_dll.dll","detail":"Microsoft: Storm-2603 IIS backdoor filename, with multiple SHA-256 hashes in the 2025-07-23 update.","sourceUrl":"https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/","sourceDate":"2025-07-23"},{"kind":"cron","value":"Scheduled task created after initial access (Storm-2603)","detail":"Microsoft: Storm-2603 established persistence through scheduled tasks and by manipulating IIS components to load suspicious .NET assemblies, in addition to the webshell.","sourceUrl":"https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/","sourceDate":"2025-07-22"},{"kind":"service","value":"Malicious IIS modules in applicationHost.config and web.config","detail":"CISA: malicious module entries persist across iisreset unless removed from those config files. Microsoft also flags IIS worker process loaded suspicious .NET assembly.","sourceUrl":"https://www.cisa.gov/news-events/alerts/2025/07/20/update-microsoft-releases-guidance-exploitation-sharepoint-vulnerabilities","sourceDate":"2025-07-22"}],"evidence":[{"title":"IIS W3C logs for ToolPane POST with SignOut Referer","detail":"Eye Security and Microsoft: POST /_layouts/15/ToolPane.aspx (also /_layouts/16/) with DisplayMode=Edit and Referer /_layouts/SignOut.aspx. Eye published a sample IIS line from 2025-07-18. Preserve IIS logs from at least 2025-07-07 (Microsoft earliest attempt date).","sources":[{"url":"https://research.eye.security/sharepoint-under-siege/","date":"2025-07-19","publisher":"Eye Security"},{"url":"https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/","date":"2025-07-22","publisher":"Microsoft"}]},{"title":"File creates under LAYOUTS and w3wp.exe children","detail":"Microsoft hunting: DeviceFileEvents under Web Server Extensions 15/16 LAYOUTS; w3wp.exe spawning cmd.exe then encoded PowerShell. Eye: powershell EncodedCommand with grandparent w3wp.exe.","sources":[{"url":"https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/","date":"2025-07-22","publisher":"Microsoft"}]},{"title":"Copy of applicationHost.config, web.config, and machine-key state","detail":"Needed to find malicious modules (CISA) and to prove whether keys were rotated after cleanup.","sources":[{"url":"https://www.cisa.gov/news-events/alerts/2025/07/20/update-microsoft-releases-guidance-exploitation-sharepoint-vulnerabilities","date":"2025-07-22","publisher":"CISA"}]},{"title":"Standard IR artifacts before rebuild","detail":"Disk image, memory if available, scheduled tasks, local users, GPO change history (Storm-2603 ransomware staging).","generic":true}],"sources":[{"url":"https://research.eye.security/sharepoint-under-siege/","date":"2025-07-19","publisher":"Eye Security"},{"url":"https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/","date":"2025-07-22","publisher":"Microsoft"},{"url":"https://www.cisa.gov/news-events/alerts/2025/07/20/update-microsoft-releases-guidance-exploitation-sharepoint-vulnerabilities","date":"2025-07-22","publisher":"CISA"},{"url":"https://www.microsoft.com/en-us/msrc/blog/2025/07/customer-guidance-for-sharepoint-vulnerability-cve-2025-53770","date":"2025-07-19","publisher":"Microsoft MSRC"},{"url":"https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/","date":"2025-07-23"}],"updatedAt":"2026-10-24","addedDate":"2026-10-24"},"bulletins":[{"vendor":"Akamai","title":"SharePoint vulnerability (RCE) under active exploitation: detections and mitigations","url":"https://www.akamai.com/blog/security-research/sharepoint-vulnerability-rce-active-exploitation-detections-mitigations","date":"2025-07-21","cve":"CVE-2025-49704, CVE-2025-53770"},{"vendor":"Azure","title":"Protect against SharePoint CVE-2025-53770 with Azure Web Application Firewall (custom rule guidance, no managed rule ID)","url":"https://techcommunity.microsoft.com/blog/azurenetworksecurityblog/protect-against-sharepoint-cve-2025-53770-with-azure-web-application-firewall-wa/4442050","date":"2026-10-23","cve":"CVE-2025-53770"},{"vendor":"Cato Networks","title":"Rapid CVE Mitigation by Cato Security Research","url":"https://www.catonetworks.com/rapid-cve-mitigation/","date":"2026-10-23","cve":"CVE-2025-53770, CVE-2025-49704","dateKind":"checked"},{"vendor":"Check Point","title":"CPAI-2025-0570 Microsoft SharePoint Server Insecure Deserialization","url":"https://advisories.checkpoint.com/defense/advisories/public/2025/cpai-2025-0570.html/","date":"2025-07-21","cve":"CVE-2025-49704, CVE-2025-53770"},{"vendor":"Cisco Talos","title":"Snort Talos Rules 2025-07-08","url":"https://www.snort.org/advisories/talos-rules-2025-07-08","date":"2025-07-08","cve":"CVE-2025-49704"},{"vendor":"Cisco Talos","title":"ToolShell: Details of CVEs affecting SharePoint servers","url":"https://blog.talosintelligence.com/toolshell-affecting-sharepoint-servers/","date":"2025-07-21","cve":"CVE-2025-53770, CVE-2025-53771, CVE-2025-49704"},{"vendor":"Citrix","title":"NetScaler signature update version 157","url":"https://docs.netscaler.com/en-us/citrix-adc/13-1/signature-alerts/signature-update-version-157.html","date":"2026-10-23","cve":"CVE-2025-49704, CVE-2025-49706, CVE-2025-53770, CVE-2025-53771","dateKind":"checked"},{"vendor":"Cloudflare","title":"Cloudflare WAF emergency release 2025-07-21","url":"https://developers.cloudflare.com/changelog/post/2025-07-21-emergency/","date":"2025-07-21","cve":"CVE-2025-53770, CVE-2025-53771"},{"vendor":"F5","title":"F5 Distributed Cloud attack signatures reference","url":"https://docs.cloud.f5.com/docs-v2/platform/reference/attack-signatures","date":"2025-07-24","cve":"CVE-2025-53770, CVE-2025-53771, CVE-2025-49704, CVE-2025-49706"},{"vendor":"Fastly","title":"Added virtual patch for CVE-2025-53770","url":"https://www.fastly.com/documentation/reference/changes/2025/07/added-virtual-patch-for-cve-2025-53770/","date":"2025-07-21","cve":"CVE-2025-53770"},{"vendor":"Fortinet","title":"FortiGuard search: CVE-2025-53770","url":"https://www.fortiguard.com/search?q=CVE-2025-53770&engine=1","date":"2025-07-23","cve":"CVE-2025-53770"},{"vendor":"Fortinet","title":"FortiGuard Outbreak Alert: Microsoft SharePoint Zero-Day","url":"https://www.fortiguard.com/outbreak-alert/microsoft-sharepoint-zero-day","date":"2026-10-23","cve":"CVE-2025-53770","dateKind":"checked"},{"vendor":"Imperva","title":"Imperva customers protected against critical ToolShell zero-day in Microsoft SharePoint","url":"https://www.imperva.com/blog/imperva-customers-protected-against-critical-toolshell-zero%E2%80%91day-in-microsoft-sharepoint/","date":"2025-07-23","cve":"CVE-2025-53770"},{"vendor":"Juniper","title":"HTTP:CTS:CVE-2025-49704RCE","url":"https://www.juniper.net/us/en/threatlabs/ips-signatures/detail.HTTP:CTS:CVE-2025-49704RCE.html","date":"2025-07-08","cve":"CVE-2025-49704, CVE-2025-53770"},{"vendor":"Juniper","title":"HTTP:CTS:MS-SHRPNT-AUTH-BYPASS","url":"https://www.juniper.net/us/en/threatlabs/ips-signatures/detail.HTTP:CTS:MS-SHRPNT-AUTH-BYPASS.html","date":"2025-10-28","cve":"CVE-2025-53771"},{"vendor":"Netskope","title":"ET EXPLOIT Microsoft SharePoint ToolPane Authentication Bypass (CVE-2025-49706) (library entry, undated)","url":"https://threatlabs.netskope.com/library/ips/et-exploit-microsoft-sharepoint-toolpane-authentication-bypass-cve-2025-49706/","date":"2026-10-23","cve":"CVE-2025-49706","dateKind":"checked"},{"vendor":"Palo Alto Networks","title":"Active exploitation of Microsoft SharePoint vulnerabilities (CVE-2025-49704, CVE-2025-49706, CVE-2025-53770)","url":"https://unit42.paloaltonetworks.com/microsoft-sharepoint-cve-2025-49704-cve-2025-49706-cve-2025-53770/","date":"2025-07-31","cve":"CVE-2025-49704, CVE-2025-49706, CVE-2025-53770"},{"vendor":"Sophos","title":"Sophos IPS signature update 18.23.58","url":"https://docs.sophos.com/releasenotes/output/en-us/nsg/IPSReleaseNotes/18.23.58.html","date":"2025-07-10","cve":"CVE-2025-49704"},{"vendor":"Sophos","title":"Sophos IPS signature update 18.23.76","url":"https://docs.sophos.com/releasenotes/output/en-us/nsg/IPSReleaseNotes/18.23.76.html","date":"2025-08-21","cve":"CVE-2025-53770, CVE-2025-53771"},{"vendor":"Trend Micro","title":"SECURITY ALERT: Microsoft SharePoint On-prem Vulnerabilities (CVE-2025-49704, CVE-2025-49706, CVE-2025-53770, CVE-2025-53771)","url":"https://success.trendmicro.com/en-US/solution/KA-0020403","date":"2026-10-23","cve":"CVE-2025-49704, CVE-2025-49706, CVE-2025-53770, CVE-2025-53771","dateKind":"checked"},{"vendor":"Zscaler","title":"CVE-2025-53770: zero-day exploit impacts Microsoft SharePoint services","url":"https://www.zscaler.com/blogs/security-research/cve-2025-53770-zero-day-exploit-impacts-microsoft-sharepoint-services","date":"2025-07-21","cve":"CVE-2025-49704, CVE-2025-53770"}],"coverage":[{"title":"Disrupting active exploitation of on-premises SharePoint vulnerabilities","publisher":"Microsoft","url":"https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/","date":"2025-07-22","type":"vendor"},{"title":"SharePoint Under Siege: ToolShell Exploit","publisher":"Eye Security","url":"https://research.eye.security/sharepoint-under-siege/","date":"2025-07-18","type":"research"},{"title":"Microsoft Releases Guidance on Exploitation of SharePoint Vulnerability CVE-2025-53770","publisher":"CISA","url":"https://www.cisa.gov/news-events/alerts/2025/07/20/microsoft-releases-guidance-exploitation-sharepoint-vulnerability-cve-2025-53770","date":"2025-07-20","type":"government"},{"title":"NVD CVE-2025-53770","publisher":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-53770","date":"2025-07-20","type":"government"}],"posts":[],"research":[{"title":"Microsoft Threat Intelligence blog","url":"https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/","authors":"Microsoft","date":"2025-07-22"},{"title":"MSRC CVE-2025-53770","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53770","authors":"Microsoft MSRC","date":"2025-07-20"},{"title":"Eye Security ToolShell report","url":"https://research.eye.security/sharepoint-under-siege/","authors":"Eye Security","date":"2025-07-18"},{"title":"CISA alert","url":"https://www.cisa.gov/news-events/alerts/2025/07/20/microsoft-releases-guidance-exploitation-sharepoint-vulnerability-cve-2025-53770","authors":"CISA","date":"2025-07-20"},{"title":"NVD CVE-2025-53770","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-53770","authors":"NVD","date":"2025-07-20"}],"impact":{"kind":"single-product","product":"Microsoft SharePoint Server (on-premises)","versions":[{"version":"SharePoint Server Subscription Edition","status":"affected","versions":"KB5002768","vendorStatement":{"date":"2025-07-22","url":"https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/","quote":"Security Update for Microsoft SharePoint Server Subscription Edition (KB5002768)."}},{"version":"SharePoint Server 2019","status":"affected","versions":"KB5002754 / KB5002753","vendorStatement":{"date":"2025-07-22","url":"https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/","quote":"Security Update for Microsoft SharePoint 2019 (KB5002754) and Language Pack (KB5002753)."}},{"version":"SharePoint Server 2016","status":"affected","versions":"KB5002760 / KB5002759","vendorStatement":{"date":"2025-07-22","url":"https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/","quote":"Security Update for Microsoft SharePoint Enterprise Server 2016 (KB5002760) and Language Pack (KB5002759)."}},{"version":"SharePoint Online (Microsoft 365)","status":"vendor-stated-not-affected","vendorStatement":{"date":"2025-07-22","url":"https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/","quote":"These vulnerabilities affect on-premises SharePoint servers only and do not affect SharePoint Online in Microsoft 365."}}]},"pocs":[{"title":"kaizensecurity/CVE-2025-53770","url":"https://github.com/kaizensecurity/CVE-2025-53770","source":"kaizensecurity","validationStatus":"unverified","validationDate":"2025-07-21","notes":"Public repository created 21 Jul 2025 and referenced from NVD. Validation status not independently confirmed here."}],"_feed":{"page":"https://vuln2shell.com/vulns/toolshell","json":"https://vuln2shell.com/vulns/toolshell.json","iocsCsv":"https://vuln2shell.com/vulns/toolshell/iocs.csv","stix":"https://vuln2shell.com/vulns/toolshell/stix.json"}}