Detects URIs accessed during the exploitation of SharePoint RCE vulnerability CVE-2025-53770

Hunt Hypothesis

This hunt hypothesis targets adversaries exploiting the critical SharePoint Remote Code Execution (RCE) vulnerability CVE-2025-53770 by identifying specific URI access patterns indicative of active exploitation attempts. Proactively hunting for these signatures in Azure Sentinel is essential to detect early-stage intrusions before attackers can establish persistence or execute malicious payloads within the organization’s collaboration infrastructure.

YARA Rule

rule APT_EXPL_Sharepoint_CVE_2025_53770_ForensicArtefact_Jul25_1 {
   meta:
      description = "Detects URIs accessed during the exploitation of SharePoint RCE vulnerability CVE-2025-53770"
      author = "Florian Roth"
      reference = "https://research.eye.security/sharepoint-under-siege/"
      date = "2025-07-20"
      modified = "2025-07-23"
      score = 75
      id = "06ad76ef-fc9c-5251-a7c0-cbbb66d79b0e"
   strings:
      $sa1 = /POST \/_layouts\/1[0-9]\/ToolPane\.aspx/ ascii wide nocase
      $sa2 = "DisplayMode=Edit&a=/ToolPane.aspx" ascii wide

      $sb1 = /GET \/_layouts\/1[0-9]\/spinstall/ ascii wide  // specific
      $sb2 = "/_layouts/SignOut.aspx 200" ascii wide nocase
   condition:
      (@sa2 - @sa1) < 700  // unknown how specific with the DisplayMode=Edit parameter
      or (@sb2 - @sb1) < 700  // specific combination
      or (@sb2 - @sa1) < 700  // most generic combination
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 4 string patterns in its detection logic.

References

• https://research.eye.security/sharepoint-under-siege/
• Source Rule

False Positive Guidance

• Scenario: Automated backup or indexing agents scanning the SharePoint content library.

  • Context: Tools like Veeam Backup & Replication or Microsoft Search perform routine deep scans of the SharePoint document libraries to index metadata and verify file integrity. These agents often generate HTTP requests to specific URI paths that mimic the payload structure of the CVE-2025-53770 exploit, triggering false positives when they access known vulnerable endpoints during their scheduled windows.
  • Suggested Filter/Exclusion: Create an exclusion rule based on the User-Agent string (e.g., VeeamBrowser, Microsoft.Search.Crawler) and restrict the alert to non-business hours if the scan is typically nightly, or exclude traffic originating from the specific IP ranges of the backup infrastructure cluster.

• Scenario: Scheduled PowerShell maintenance scripts executed by System Administrators.

  • Context: Enterprise administrators run recurring PowerShell scripts (e.g., Start-SPSiteAudit, Update-SharePointContent) to manage site collections, rotate permissions, or archive old data. These scripts often invoke the SharePoint REST API using specific URI patterns that overlap with the vulnerability’s exploitation signature, particularly when accessing the _api endpoints during the script execution phase.
  • Suggested Filter/Exclusion: Implement a filter that excludes traffic where the source IP belongs to the Domain Controller or designated Management Server subnets, and correlate the alert timestamp with the scheduled task ID (e.g., Task Scheduler job name containing “SharePoint_Maintenance”) to suppress alerts during known maintenance windows.

• Scenario: Third-party integration webhooks from CRM or ERP systems.

  • Context: Integrated business applications such as Salesforce, SAP SuccessFactors, or ServiceNow utilize webhooks to push real-time updates (e.g., new hire