Windows File Creation in SharePoint Web Server Extensions Suggesting ToolShell Drop
Alerts on Windows file creations within SharePoint Web Server Extensions that match suspicious spinstall/debug artifacts linked to CVE-2025-53770.
- Product
- windows
- Category
- file_event
- Author
- Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2025-07-21
- Updated
- 2026-07-31
ATT&CK techniques
Initial AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags creation of files within SharePoint Web Server Extensions paths, with filename patterns consistent with ToolShell-style payload drops (for example spinstall*.aspx and debug_dev.js under template layouts). Attackers may create these web-accessible files to gain execution or persist during exploitation attempts. Telemetry required is Windows file event data that includes the full TargetFilename for newly created or written files.
Reporting behind it
- research.eye.securityhttps://research.eye.security/sharepoint-under-siege/
- msrc.microsoft.comhttps://msrc.microsoft.com/blog/2025/07/customer-guidance-for-sharepoint-vulnerability-cve-2025-53770/
- unit42.paloaltonetworks.comhttps://unit42.paloaltonetworks.com/microsoft-sharepoint-cve-2025-49704-cve-2025-49706-cve-2025-53770/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2025/Exploits/CVE-2025-53770/file_event_win_exploit_cve_2025_53770.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows File Creation in SharePoint Web Server Extensions Suggesting ToolShell Drop
id: 3001485a-3f0e-45ea-b3e2-350d8e9a0b1f
status: experimental
description: This rule flags creation of files within SharePoint Web Server Extensions paths, with filename patterns consistent with ToolShell-style payload drops (for example spinstall*.aspx and debug_dev.js under template layouts). Attackers may create these web-accessible files to gain execution or persist during exploitation attempts. Telemetry required is Windows file event data that includes the full TargetFilename for newly created or written files.
references:
- https://research.eye.security/sharepoint-under-siege/
- https://msrc.microsoft.com/blog/2025/07/customer-guidance-for-sharepoint-vulnerability-cve-2025-53770/
- https://unit42.paloaltonetworks.com/microsoft-sharepoint-cve-2025-49704-cve-2025-49706-cve-2025-53770/
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2025/Exploits/CVE-2025-53770/file_event_win_exploit_cve_2025_53770.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-07-21
modified: 2025-07-24
tags:
- attack.initial-access
- attack.t1190
- cve.2025-53770
- detection.emerging-threats
logsource:
product: windows
category: file_event
detection:
selection:
TargetFilename|startswith:
- C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\
- C:\Program Files (x86)\Common Files\Microsoft Shared\Web Server Extensions\
TargetFilename|contains:
- \15\TEMPLATE\LAYOUTS\
- \16\TEMPLATE\LAYOUTS\
TargetFilename|endswith:
- \spinstall.aspx
- \spinstall?.aspx
- \debug_dev.js
condition: selection
falsepositives:
- Unknown
level: critical
license: DRL-1.1
related:
- id: ba479447-721f-42a9-9af2-6dcd517bbdb3
type: derived