IIS Web Logs: SharePoint ToolPane and spinstall0 POST/GET Indicative of CVE-2025-53770 Exploitation

title: "IIS Web Logs: SharePoint ToolPane and spinstall0 POST/GET Indicative of CVE-2025-53770 Exploitation"
id: faba7e81-80d2-4cd9-a759-7cd728f8ffab
status: experimental
description: This rule flags IIS web requests to specific SharePoint layout endpoints associated with ToolPane editing and spinstall0 behavior, combined with a referer containing SignOut. Attackers may use these request patterns to reach vulnerable SharePoint components via the IIS web surface. The detection relies on IIS web server log fields including HTTP method, URI stem, query strings, and the referer value.
references:
  - https://www.linkedin.com/posts/mauricefielenbach_sharepoint-incidentresponse-windowssecurity-activity-7352653907363303425-bL2f
  - https://research.eye.security/sharepoint-under-siege/
  - https://msrc.microsoft.com/blog/2025/07/customer-guidance-for-sharepoint-vulnerability-cve-2025-53770/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2025/Exploits/CVE-2025-53770/web_win_iis_exploit_cve_2025_53770.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-07-21
tags:
  - attack.initial-access
  - attack.t1190
  - cve.2025-53770
  - detection.emerging-threats
logsource:
  category: webserver
detection:
  selection_exploit_post:
    cs-method: POST
    cs-uri-stem|contains: /_layouts/15/ToolPane.aspx
    cs-uri-query|contains: DisplayMode=Edit&a=/ToolPane.aspx
  selection_exploit_get:
    cs-method: GET
    cs-uri-stem|contains: /_layouts/15/spinstall0.aspx
  selection_referer:
    cs-referer|contains: /_layouts/SignOut.aspx
  condition: 1 of selection_exploit_* and selection_referer
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 48d053db-6a56-4866-b60d-0975647050ed
    type: derived