IIS Web Logs: SharePoint ToolPane and spinstall0.aspx CVE-2025-53770 Exploitation Indicators
Alerts on IIS log traffic to SharePoint ToolPane/spinstall0 endpoints with a SignOut referer, matching indicators for CVE-2025-53770 exploitation.
- Category
- webserver
- Author
- Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2025-07-21
- Updated
- 2026-07-31
ATT&CK techniques
Initial AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags IIS web requests consistent with exploitation attempts targeting SharePoint endpoints. It matches POST traffic to /_layouts/15/ToolPane.aspx with a DisplayMode=Edit query and GET traffic to /_layouts/15/spinstall0.aspx, combined with a referer containing /_layouts/SignOut.aspx. The detection relies on web server log fields for HTTP method, URI stem, query string content, and HTTP referrer.
Reporting behind it
- linkedin.comhttps://www.linkedin.com/posts/mauricefielenbach_sharepoint-incidentresponse-windowssecurity-activity-7352653907363303425-bL2f
- research.eye.securityhttps://research.eye.security/sharepoint-under-siege/
- msrc.microsoft.comhttps://msrc.microsoft.com/blog/2025/07/customer-guidance-for-sharepoint-vulnerability-cve-2025-53770/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2025/Exploits/CVE-2025-53770/web_win_iis_exploit_cve_2025_53770.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "IIS Web Logs: SharePoint ToolPane and spinstall0.aspx CVE-2025-53770 Exploitation Indicators"
id: faba7e81-80d2-4cd9-a759-7cd728f8ffab
status: experimental
description: This rule flags IIS web requests consistent with exploitation attempts targeting SharePoint endpoints. It matches POST traffic to /_layouts/15/ToolPane.aspx with a DisplayMode=Edit query and GET traffic to /_layouts/15/spinstall0.aspx, combined with a referer containing /_layouts/SignOut.aspx. The detection relies on web server log fields for HTTP method, URI stem, query string content, and HTTP referrer.
references:
- https://www.linkedin.com/posts/mauricefielenbach_sharepoint-incidentresponse-windowssecurity-activity-7352653907363303425-bL2f
- https://research.eye.security/sharepoint-under-siege/
- https://msrc.microsoft.com/blog/2025/07/customer-guidance-for-sharepoint-vulnerability-cve-2025-53770/
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2025/Exploits/CVE-2025-53770/web_win_iis_exploit_cve_2025_53770.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-07-21
tags:
- attack.initial-access
- attack.t1190
- cve.2025-53770
- detection.emerging-threats
logsource:
category: webserver
detection:
selection_exploit_post:
cs-method: POST
cs-uri-stem|contains: /_layouts/15/ToolPane.aspx
cs-uri-query|contains: DisplayMode=Edit&a=/ToolPane.aspx
selection_exploit_get:
cs-method: GET
cs-uri-stem|contains: /_layouts/15/spinstall0.aspx
selection_referer:
cs-referer|contains: /_layouts/SignOut.aspx
condition: 1 of selection_exploit_* and selection_referer
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: 48d053db-6a56-4866-b60d-0975647050ed
type: derived