Phoenix Studio
Convert indexed Sigma rules into analyst-ready detections.
This studio is built around Phoenix's own rule corpus, not a blank editor. Search by title or rule id, choose a local pySigma backend, then reveal pipelines only when you actually need them.
Indexed Rules
3,731
Ready to search
Backends
17
Loaded from pysigma-node
pySigma Versions
10
Newest: 1.3.3
Translation Workspace
Shape the rule before it leaves Phoenix
Tune Translation
Active Rule
SharePoint ToolShell CVE-2025-53770 Exploitation - Web IIS
Target Profile
Splunk
Splunk through pysigma-backend-splunk.
Format Mode
Default
Default pySigma output mode for this backend.
Conversion Output
SharePoint ToolShell CVE-2025-53770 Exploitation - Web IIS
Using Splunk · Default · pySigma 1.3.3
Translation controls
Adjust the rule on the left, then regenerate when you want a fresh backend-native query.
BackendSplunkFormatDefaultVersion1.3.3
title: SharePoint ToolShell CVE-2025-53770 Exploitation - Web IIS
id: 48d053db-6a56-4866-b60d-0975647050ed
status: experimental
description: |
Detects access to vulnerable SharePoint components potentially being exploited in CVE-2025-53770 through IIS web server logs.
CVE-2025-53770 is a zero-day vulnerability in SharePoint that allows remote code execution.
references:
- https://www.linkedin.com/posts/mauricefielenbach_sharepoint-incidentresponse-windowssecurity-activity-7352653907363303425-bL2f
- https://research.eye.security/sharepoint-under-siege/
- https://msrc.microsoft.com/blog/2025/07/customer-guidance-for-sharepoint-vulnerability-cve-2025-53770/
author: Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2025-07-21
tags:
- attack.initial-access
- attack.t1190
- cve.2025-53770
- detection.emerging-threats
logsource:
category: webserver # IIS web server logs
detection:
selection_exploit_post:
cs-method: 'POST'
cs-uri-stem|contains: '/_layouts/15/ToolPane.aspx'
cs-uri-query|contains: 'DisplayMode=Edit&a=/ToolPane.aspx'
selection_exploit_get:
cs-method: 'GET'
cs-uri-stem|contains: '/_layouts/15/spinstall0.aspx'
selection_referer:
cs-referer|contains: '/_layouts/SignOut.aspx'
condition: 1 of selection_exploit_* and selection_referer
falsepositives:
- Unknown
level: medium
CLI command
Copy the exact command to reproduce this translation locally.
sigma convert --without-pipeline -t splunk -f default rules-emerging-threats/2025/Exploits/CVE-2025-53770/web_win_iis_exploit_cve_2025_53770.yml