huntrule

Windows Process Creation: Indicators of SharePoint spinstall0.aspx Encoded Command Exploitation (CVE-2025-53770)

Alerts on w3wp.exe command lines containing encoded spinstall0.aspx and SharePoint template layout path indicators consistent with CVE-2025-53770 exploitation.

FreeUnreviewedSigmahighv1
title: "Windows Process Creation: Indicators of SharePoint spinstall0.aspx Encoded Command Exploitation (CVE-2025-53770)"
id: 5221e6d7-4586-4db2-b5cb-d9590a14cb1d
status: experimental
description: This rule flags Windows process creation events where w3wp.exe launches commands containing encoded indicators tied to spinstall0.aspx and SharePoint template paths. Such activity can reflect post-exploitation behavior attempting to execute payloads through web application worker processes. The detection relies on process command-line telemetry and specific encoded strings/patterns observed in those command lines.
references:
  - https://research.eye.security/sharepoint-under-siege/
  - https://msrc.microsoft.com/blog/2025/07/customer-guidance-for-sharepoint-vulnerability-cve-2025-53770/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2025/Exploits/CVE-2025-53770/proc_creation_win_exploit_cve_2025_53770_indicators.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-07-21
tags:
  - attack.initial-access
  - attack.t1190
  - cve.2025-53770
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    ParentImage|endswith: \w3wp.exe
  selection_encoded_aspx:
    - CommandLine|wide|base64offset|contains: spinstall0.aspx
    - CommandLine|base64|contains: spinstall0.aspx
  selection_encoded_path:
    CommandLine|wide|base64offset|contains:
      - :\PROGRA~1\COMMON~1\MICROS~1\WEBSER~1\15\TEMPLATE\LAYOUTS
      - :\PROGRA~1\COMMON~1\MICROS~1\WEBSER~1\16\TEMPLATE\LAYOUTS
      - :\Program Files\Common Files\Microsoft Shared\Web Server Extensions\15\TEMPLATE\LAYOUTS
      - :\Program Files\Common Files\Microsoft Shared\Web Server Extensions\16\TEMPLATE\LAYOUTS
  selection_ioc:
    CommandLine|contains:
      - -EncodedCommand JABiAGEAcwBlADYANABTAHQAcgBpAG4AZwAgAD0
      - TEMPLATE\LAYOUTS\spinstall0.aspx
  condition: (selection_img and 1 of selection_encoded_*) or selection_ioc
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 7477881c-ec3b-49d6-aced-7255944e5c59
    type: derived

What it detects

This rule flags Windows process creation events where w3wp.exe launches commands containing encoded indicators tied to spinstall0.aspx and SharePoint template paths. Such activity can reflect post-exploitation behavior attempting to execute payloads through web application worker processes. The detection relies on process command-line telemetry and specific encoded strings/patterns observed in those command lines.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.