Sigma rule: SharePoint ToolShell CVE-2025-53770 Exploitation - Web IIS

Rule

Title

SharePoint ToolShell CVE-2025-53770 Exploitation - Web IIS

Status

experimental

Level

medium

Author

Swachchhanda Shrawan Poudel (Nextron Systems)

Date

2025-07-21

File

rules-emerging-threats/2025/Exploits/CVE-2025-53770/web_win_iis_exploit_cve_2025_53770.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects access to vulnerable SharePoint components potentially being exploited in CVE-2025-53770 through IIS web server logs.
CVE-2025-53770 is a zero-day vulnerability in SharePoint that allows remote code execution.

Log source

category

webserver

Detection

selection_exploit_post:
    cs-method: 'POST'
    cs-uri-stem|contains: '/_layouts/15/ToolPane.aspx'
    cs-uri-query|contains: 'DisplayMode=Edit&a=/ToolPane.aspx'
selection_exploit_get:
    cs-method: 'GET'
    cs-uri-stem|contains: '/_layouts/15/spinstall0.aspx'
selection_referer:
    cs-referer|contains: '/_layouts/SignOut.aspx'
condition: 1 of selection_exploit_* and selection_referer

False positives (as the rule lists them)

• Unknown

Tags

• attack.initial-access
• attack.t1190
• cve.2025-53770
• detection.emerging-threats

CVEs this rule names

• CVE-2025-53770

MITRE ATT&CK ids this rule names

• T1190

References

• https://www.linkedin.com/posts/mauricefielenbach_sharepoint-incidentresponse-windowssecurity-activity-7352653907363303425-bL2f
• https://research.eye.security/sharepoint-under-siege/
• https://msrc.microsoft.com/blog/2025/07/customer-guidance-for-sharepoint-vulnerability-cve-2025-53770/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-emerging-threats/2025/Exploits/CVE-2025-53770/web_win_iis_exploit_cve_2025_53770.yml