huntrule

Windows File Write via Command-Line Tools to SharePoint Layouts Web Assets

Alerts on cmd/powershell/w3wp writes of script or web asset files into SharePoint layouts (15/16 TEMPLATE/ LAYOUTS).

FreeUnreviewedSigmahighv1
title: Windows File Write via Command-Line Tools to SharePoint Layouts Web Assets
id: fc8c19a5-1c8d-4fd9-a00c-7c08cbac303a
status: experimental
description: This rule flags file write activity where a process associated with cmd.exe or PowerShell (including w3wp.exe) writes files under SharePoint Web Server Extensions TEMPLATE/15-16 layouts paths. Such writes can be used to deploy web-accessible content for webshell-style persistence or post-exploitation payload staging. The detection relies on Windows file event telemetry capturing both the writing process executable and the target file path and extension.
references:
  - https://unit42.paloaltonetworks.com/microsoft-sharepoint-cve-2025-49704-cve-2025-49706-cve-2025-53770/
  - https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_susp_filewrite_in_sharepoint_layouts_dir.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-07-24
tags:
  - attack.initial-access
  - attack.t1190
  - attack.persistence
  - attack.t1505.003
logsource:
  product: windows
  category: file_event
detection:
  selection:
    Image|endswith:
      - \cmd.exe
      - \powershell_ise.exe
      - \powershell.exe
      - \pwsh.exe
      - \w3wp.exe
    TargetFilename|startswith:
      - C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\
      - C:\Program Files (x86)\Common Files\Microsoft Shared\Web Server Extensions\
    TargetFilename|contains:
      - \15\TEMPLATE\LAYOUTS\
      - \16\TEMPLATE\LAYOUTS\
    TargetFilename|endswith:
      - .asax
      - .ascx
      - .ashx
      - .asmx
      - .asp
      - .aspx
      - .bat
      - .cmd
      - .cer
      - .config
      - .hta
      - .js
      - .jsp
      - .jspx
      - .php
      - .ps1
      - .vbs
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 1f0489be-b496-4ddf-b3a9-5900f2044e9c
    type: derived

What it detects

This rule flags file write activity where a process associated with cmd.exe or PowerShell (including w3wp.exe) writes files under SharePoint Web Server Extensions TEMPLATE/15-16 layouts paths. Such writes can be used to deploy web-accessible content for webshell-style persistence or post-exploitation payload staging. The detection relies on Windows file event telemetry capturing both the writing process executable and the target file path and extension.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.