Windows File Creation in SharePoint Web Server Extensions Indicative of CVE-2025-53770 Exploitation

title: Windows File Creation in SharePoint Web Server Extensions Indicative of CVE-2025-53770 Exploitation
id: 3001485a-3f0e-45ea-b3e2-350d8e9a0b1f
status: experimental
description: This rule flags file creation events targeting SharePoint Web Server Extensions paths and specific file names/patterns associated with Web shell or deployment artifacts (e.g., spinstall*.aspx or debug_dev.js). Attackers may create these files to establish remote code execution or place malicious components in SharePoint’s web-accessible directories. The detection relies on Windows file event telemetry capturing TargetFilename path strings matching the defined prefixes, substrings, and suffixes.
references:
  - https://research.eye.security/sharepoint-under-siege/
  - https://msrc.microsoft.com/blog/2025/07/customer-guidance-for-sharepoint-vulnerability-cve-2025-53770/
  - https://unit42.paloaltonetworks.com/microsoft-sharepoint-cve-2025-49704-cve-2025-49706-cve-2025-53770/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2025/Exploits/CVE-2025-53770/file_event_win_exploit_cve_2025_53770.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-07-21
modified: 2025-07-24
tags:
  - attack.initial-access
  - attack.t1190
  - cve.2025-53770
  - detection.emerging-threats
logsource:
  product: windows
  category: file_event
detection:
  selection:
    TargetFilename|startswith:
      - C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\
      - C:\Program Files (x86)\Common Files\Microsoft Shared\Web Server Extensions\
    TargetFilename|contains:
      - \15\TEMPLATE\LAYOUTS\
      - \16\TEMPLATE\LAYOUTS\
    TargetFilename|endswith:
      - \spinstall.aspx
      - \spinstall?.aspx
      - \debug_dev.js
  condition: selection
falsepositives:
  - Unknown
level: critical
license: DRL-1.1
related:
  - id: ba479447-721f-42a9-9af2-6dcd517bbdb3
    type: derived