Sigma rule: Suspicious File Write to SharePoint Layouts Directory

Rule

Title

Suspicious File Write to SharePoint Layouts Directory

Status

experimental

Level

high

Author

Swachchhanda Shrawan Poudel (Nextron Systems)

Date

2025-07-24

File

rules/windows/file/file_event/file_event_win_susp_filewrite_in_sharepoint_layouts_dir.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects suspicious file writes to SharePoint layouts directory which could indicate webshell activity or post-exploitation.
This behavior has been observed in the exploitation of SharePoint vulnerabilities such as CVE-2025-49704, CVE-2025-49706 or CVE-2025-53770.

Log source

product

windows

category

file_event

Detection

selection:
    Image|endswith:
        - '\cmd.exe'
        - '\powershell_ise.exe'
        - '\powershell.exe'
        - '\pwsh.exe'
        - '\w3wp.exe'
    TargetFilename|startswith:
        - 'C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\'
        - 'C:\Program Files (x86)\Common Files\Microsoft Shared\Web Server Extensions\'
    TargetFilename|contains:
        - '\15\TEMPLATE\LAYOUTS\'
        - '\16\TEMPLATE\LAYOUTS\'
    TargetFilename|endswith:
        - '.asax'
        - '.ascx'
        - '.ashx'
        - '.asmx'
        - '.asp'
        - '.aspx'
        - '.bat'
        - '.cmd'
        - '.cer'
        - '.config'
        - '.hta'
        - '.js'
        - '.jsp'
        - '.jspx'
        - '.php'
        - '.ps1'
        - '.vbs'
condition: selection

False positives (as the rule lists them)

• Unknown

Tags

• attack.initial-access
• attack.t1190
• attack.persistence
• attack.t1505.003

MITRE ATT&CK ids this rule names

• T1190
• T1505.003

References

• https://unit42.paloaltonetworks.com/microsoft-sharepoint-cve-2025-49704-cve-2025-49706-cve-2025-53770/
• https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/file/file_event/file_event_win_susp_filewrite_in_sharepoint_layouts_dir.yml