Windows Suspicious File Writes to SharePoint Web Server Extensions Layouts Directory
Alerts on cmd/powershell/w3wp writes of script or web asset files into SharePoint layouts (15/16 TEMPLATE/ LAYOUTS).
- Product
- windows
- Category
- file_event
- Author
- Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2025-07-24
- Updated
- 2026-07-31
ATT&CK techniques
Initial Access → PersistenceRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags file write events targeting SharePoint Web Server Extensions TEMPLATE LAYOUTS paths with filenames/extensions commonly used for executable or web content (for example .aspx, .asp, .php, .ps1, .cmd, and .js). Attackers may use these writes to stage webshells or establish persistence after compromising SharePoint-hosting components. It relies on Windows file event telemetry that includes the writing process image and the target filename.
Reporting behind it
- unit42.paloaltonetworks.comhttps://unit42.paloaltonetworks.com/microsoft-sharepoint-cve-2025-49704-cve-2025-49706-cve-2025-53770/
- microsoft.comhttps://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_susp_filewrite_in_sharepoint_layouts_dir.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Suspicious File Writes to SharePoint Web Server Extensions Layouts Directory
id: fc8c19a5-1c8d-4fd9-a00c-7c08cbac303a
status: experimental
description: This rule flags file write events targeting SharePoint Web Server Extensions TEMPLATE LAYOUTS paths with filenames/extensions commonly used for executable or web content (for example .aspx, .asp, .php, .ps1, .cmd, and .js). Attackers may use these writes to stage webshells or establish persistence after compromising SharePoint-hosting components. It relies on Windows file event telemetry that includes the writing process image and the target filename.
references:
- https://unit42.paloaltonetworks.com/microsoft-sharepoint-cve-2025-49704-cve-2025-49706-cve-2025-53770/
- https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_susp_filewrite_in_sharepoint_layouts_dir.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-07-24
tags:
- attack.initial-access
- attack.t1190
- attack.persistence
- attack.t1505.003
logsource:
product: windows
category: file_event
detection:
selection:
Image|endswith:
- \cmd.exe
- \powershell_ise.exe
- \powershell.exe
- \pwsh.exe
- \w3wp.exe
TargetFilename|startswith:
- C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\
- C:\Program Files (x86)\Common Files\Microsoft Shared\Web Server Extensions\
TargetFilename|contains:
- \15\TEMPLATE\LAYOUTS\
- \16\TEMPLATE\LAYOUTS\
TargetFilename|endswith:
- .asax
- .ascx
- .ashx
- .asmx
- .asp
- .aspx
- .bat
- .cmd
- .cer
- .config
- .hta
- .js
- .jsp
- .jspx
- .php
- .ps1
- .vbs
condition: selection
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 1f0489be-b496-4ddf-b3a9-5900f2044e9c
type: derived