Sigma rule: Potential SharePoint ToolShell CVE-2025-53770 Exploitation - File Create

Rule

Title

Potential SharePoint ToolShell CVE-2025-53770 Exploitation - File Create

Status

experimental

Level

critical

Author

Swachchhanda Shrawan Poudel (Nextron Systems)

Date

2025-07-21

Modified

2025-07-24

File

rules-emerging-threats/2025/Exploits/CVE-2025-53770/file_event_win_exploit_cve_2025_53770.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects the creation of file such as spinstall0.aspx which may indicate successful exploitation of CVE-2025-53770.
CVE-2025-53770 is a zero-day vulnerability in SharePoint that allows remote code execution.

Log source

product

windows

category

file_event

Detection

selection:
    TargetFilename|startswith:
        - 'C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\'
        - 'C:\Program Files (x86)\Common Files\Microsoft Shared\Web Server Extensions\'
    TargetFilename|contains:
        - '\15\TEMPLATE\LAYOUTS\'
        - '\16\TEMPLATE\LAYOUTS\'
    TargetFilename|endswith:
        - '\spinstall.aspx'
        - '\spinstall?.aspx'
        - '\debug_dev.js'
condition: selection

False positives (as the rule lists them)

• Unknown

Tags

• attack.initial-access
• attack.t1190
• cve.2025-53770
• detection.emerging-threats

CVEs this rule names

• CVE-2025-53770

MITRE ATT&CK ids this rule names

• T1190

References

• https://research.eye.security/sharepoint-under-siege/
• https://msrc.microsoft.com/blog/2025/07/customer-guidance-for-sharepoint-vulnerability-cve-2025-53770/
• https://unit42.paloaltonetworks.com/microsoft-sharepoint-cve-2025-49704-cve-2025-49706-cve-2025-53770/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-emerging-threats/2025/Exploits/CVE-2025-53770/file_event_win_exploit_cve_2025_53770.yml