Emerging Threatmediumexperimental

SharePoint ToolShell CVE-2025-53770 Exploitation - Web IIS

Detects access to vulnerable SharePoint components potentially being exploited in CVE-2025-53770 through IIS web server logs. CVE-2025-53770 is a zero-day vulnerability in SharePoint that allows remote code execution.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch
Swachchhanda Shrawan Poudel (Nextron Systems)Created Mon Jul 2148d053db-6a56-4866-b60d-0975647050ed2025
Emerging Threat
Active Threat

Developed to detect an active or emerging threat. Prioritize investigation of any alerts and correlate with threat intelligence.

Log Source
Web Server Log
CategoryWeb Server Log← raw: webserver

HTTP access logs from web servers capturing request paths, methods, and status codes.

Detection Logic
Detection Logic3 selectors
detection:
    selection_exploit_post:
        cs-method: 'POST'
        cs-uri-stem|contains: '/_layouts/15/ToolPane.aspx'
        cs-uri-query|contains: 'DisplayMode=Edit&a=/ToolPane.aspx'
    selection_exploit_get:
        cs-method: 'GET'
        cs-uri-stem|contains: '/_layouts/15/spinstall0.aspx'
    selection_referer:
        cs-referer|contains: '/_layouts/SignOut.aspx'
    condition: 1 of selection_exploit_* and selection_referer
False Positives
Unknown

False positive likelihood has not been assessed. Additional context may be needed during triage.

MITRE ATT&CK

Other

cve.2025-53770detection.emerging-threats
Rule Metadata
Rule ID
48d053db-6a56-4866-b60d-0975647050ed
Status
experimental
Level
medium
Type
Emerging Threat
Created
Mon Jul 21
Path
rules-emerging-threats/2025/Exploits/CVE-2025-53770/web_win_iis_exploit_cve_2025_53770.yml
Raw Tags
attack.initial-accessattack.t1190cve.2025-53770detection.emerging-threats
View on GitHub