huntrule

Windows Suspicious File Writes to SharePoint Web Server Extensions Layouts Directory

Alerts on cmd/powershell/w3wp writes of script or web asset files into SharePoint layouts (15/16 TEMPLATE/ LAYOUTS).

FreeReviewedSigma · High · v2
Product
windows
Category
file_event
Author
Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2025-07-24
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Initial Access → Persistence

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags file write events targeting SharePoint Web Server Extensions TEMPLATE LAYOUTS paths with filenames/extensions commonly used for executable or web content (for example .aspx, .asp, .php, .ps1, .cmd, and .js). Attackers may use these writes to stage webshells or establish persistence after compromising SharePoint-hosting components. It relies on Windows file event telemetry that includes the writing process image and the target filename.

Reporting behind it

Related detections9 linkedT1190 — drag to rearrange
Malicious Web Shell Written to SharePoint LAYOUTS Directory by Worker Process (via file_event)
Malicious Command Shell Spawned by SQL Server via Process Creation (via process_creation)
Possible GoAnywhere MFT Exploitation via Tomcat Spawning Discovery Commands
Suspicious Command Shell Spawned by MSSQL Server Process Indicating Webshell
Malicious MOVEit Transfer Exploitation via X-siLock HTTP Headers (via webserver)
Malicious IIS w3wp Worker Spawning Command Interpreter via SharePoint Web Shell
Suspicious Single-Character Named Executable Launched by Web Server Process (via process_creation)
Malicious MOVEit human2.aspx Web Shell Dropped in wwwroot (via file_event)
Malicious IIS Worker Process Spawning PowerShell via Gladinet CentreStack Exploit
Windows Suspicious File Writes to SharePoint Web Server Extensions Layouts Directory
Pivot detection · T1190 · 9 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.