Windows Process Creation: Indicators of SharePoint spinstall0.aspx Encoded Command Exploitation (CVE-2025-53770)
Alerts on w3wp.exe command lines containing encoded spinstall0.aspx and SharePoint template layout path indicators consistent with CVE-2025-53770 exploitation.
- Product
- windows
- Category
- process_creation
- Author
- Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2025-07-21
- Updated
- 2026-07-30
ATT&CK techniques
Initial AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows process creation events where w3wp.exe launches commands containing encoded indicators tied to spinstall0.aspx and SharePoint template paths. Such activity can reflect post-exploitation behavior attempting to execute payloads through web application worker processes. The detection relies on process command-line telemetry and specific encoded strings/patterns observed in those command lines.
Reporting behind it
- research.eye.securityhttps://research.eye.security/sharepoint-under-siege/
- msrc.microsoft.comhttps://msrc.microsoft.com/blog/2025/07/customer-guidance-for-sharepoint-vulnerability-cve-2025-53770/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2025/Exploits/CVE-2025-53770/proc_creation_win_exploit_cve_2025_53770_indicators.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Process Creation: Indicators of SharePoint spinstall0.aspx Encoded Command Exploitation (CVE-2025-53770)"
id: 5221e6d7-4586-4db2-b5cb-d9590a14cb1d
status: experimental
description: This rule flags Windows process creation events where w3wp.exe launches commands containing encoded indicators tied to spinstall0.aspx and SharePoint template paths. Such activity can reflect post-exploitation behavior attempting to execute payloads through web application worker processes. The detection relies on process command-line telemetry and specific encoded strings/patterns observed in those command lines.
references:
- https://research.eye.security/sharepoint-under-siege/
- https://msrc.microsoft.com/blog/2025/07/customer-guidance-for-sharepoint-vulnerability-cve-2025-53770/
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2025/Exploits/CVE-2025-53770/proc_creation_win_exploit_cve_2025_53770_indicators.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-07-21
tags:
- attack.initial-access
- attack.t1190
- cve.2025-53770
- detection.emerging-threats
logsource:
category: process_creation
product: windows
detection:
selection_img:
ParentImage|endswith: \w3wp.exe
selection_encoded_aspx:
- CommandLine|wide|base64offset|contains: spinstall0.aspx
- CommandLine|base64|contains: spinstall0.aspx
selection_encoded_path:
CommandLine|wide|base64offset|contains:
- :\PROGRA~1\COMMON~1\MICROS~1\WEBSER~1\15\TEMPLATE\LAYOUTS
- :\PROGRA~1\COMMON~1\MICROS~1\WEBSER~1\16\TEMPLATE\LAYOUTS
- :\Program Files\Common Files\Microsoft Shared\Web Server Extensions\15\TEMPLATE\LAYOUTS
- :\Program Files\Common Files\Microsoft Shared\Web Server Extensions\16\TEMPLATE\LAYOUTS
selection_ioc:
CommandLine|contains:
- -EncodedCommand JABiAGEAcwBlADYANABTAHQAcgBpAG4AZwAgAD0
- TEMPLATE\LAYOUTS\spinstall0.aspx
condition: (selection_img and 1 of selection_encoded_*) or selection_ioc
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 7477881c-ec3b-49d6-aced-7255944e5c59
type: derived