Emerging Threatmediumexperimental
SharePoint ToolShell CVE-2025-53770 Exploitation - Web IIS
Detects access to vulnerable SharePoint components potentially being exploited in CVE-2025-53770 through IIS web server logs. CVE-2025-53770 is a zero-day vulnerability in SharePoint that allows remote code execution.
Convert In Phoenix Studio
Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.
Launch
Swachchhanda Shrawan Poudel (Nextron Systems)Created Mon Jul 2148d053db-6a56-4866-b60d-0975647050ed2025
Emerging Threat
Active Threat
Developed to detect an active or emerging threat. Prioritize investigation of any alerts and correlate with threat intelligence.
Log Source
Web Server Log
CategoryWeb Server Log← raw: webserver
HTTP access logs from web servers capturing request paths, methods, and status codes.
Detection Logic
Detection Logic3 selectors
detection:
selection_exploit_post:
cs-method: 'POST'
cs-uri-stem|contains: '/_layouts/15/ToolPane.aspx'
cs-uri-query|contains: 'DisplayMode=Edit&a=/ToolPane.aspx'
selection_exploit_get:
cs-method: 'GET'
cs-uri-stem|contains: '/_layouts/15/spinstall0.aspx'
selection_referer:
cs-referer|contains: '/_layouts/SignOut.aspx'
condition: 1 of selection_exploit_* and selection_refererFalse Positives
Unknown
False positive likelihood has not been assessed. Additional context may be needed during triage.
MITRE ATT&CK
Tactics
Other
cve.2025-53770detection.emerging-threats
Rule Metadata
Rule ID
48d053db-6a56-4866-b60d-0975647050ed
Status
experimental
Level
medium
Type
Emerging Threat
Created
Mon Jul 21
Path
rules-emerging-threats/2025/Exploits/CVE-2025-53770/web_win_iis_exploit_cve_2025_53770.yml
Raw Tags
attack.initial-accessattack.t1190cve.2025-53770detection.emerging-threats