Detects URIs accessed during the exploitation of SharePoint RCE vulnerability CVE-2025-53770

Hunt Hypothesis

This hunt hypothesis identifies adversaries exploiting the critical SharePoint Remote Code Execution (RCE) vulnerability CVE-2025-53770 by monitoring for specific URI patterns indicative of active exploitation attempts. Proactive hunting in Azure Sentinel is essential to rapidly detect and contain potential unauthorized code execution before attackers can establish persistence or exfiltrate sensitive data from the organization’s SharePoint infrastructure.

YARA Rule

rule APT_EXPL_Sharepoint_CVE_2025_53770_ForensicArtefact_Jul25_2 {
   meta:
      description = "Detects URIs accessed during the exploitation of SharePoint RCE vulnerability CVE-2025-53770"
      author = "Florian Roth"
      reference = "https://research.eye.security/sharepoint-under-siege/"
      date = "2025-07-20"
      modified = "2025-07-24"
      hash = "30955794792a7ce045660bb1e1917eef36f1d5865891b8110bf982382b305b27"
      hash = "b336f936be13b3d01a8544ea3906193608022b40c28dd8f1f281e361c9b64e93"
      score = 70
      id = "c6f26461-04b8-5d69-bf28-e47411c38c82"
   strings:
      $x1 = "-EncodedCommand JABiAGEAcwBlADYANABTAHQAcgBpAG4AZwAgAD0" ascii wide
      $x2 = "TEMPLATE\\LAYOUTS\\spinstall" ascii wide
      $x3 = "TEMPLATE\\LAYOUTS\\ghostfile" ascii wide
      $x4 = "TEMPLATE\\LAYOUTS\\1.css" ascii wide
      $x5 = "Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64;+rv:120.0)+Gecko/20100101+Firefox/120.0 /_layouts/SignOut.aspx" ascii wide

      // Encoded code from the dropper (UTF-16 & Base64 encoded)
      // MICROS~1\WEBSER~1\16\TEMPLATE\LAYOUTS\
      // as found in sample f36a11d196db49c80123adf126b78609d0b2f5a0d9850163b6dda27048d17cbc
      $xe1 = "TQBJAEMAUgBPAFMAfgAxAFwAVwBFAEIAUwBFAFIAfgAxAFwAMQA2AFwAVABFAE0AUABMAEEAVABFAFwATABBAFkATwBVAFQAUwBcA"
      $xe2 = "0ASQBDAFIATwBTAH4AMQBcAFcARQBCAFMARQBSAH4AMQBcADEANgBcAFQARQBNAFAATABBAFQARQBcAEwAQQBZAE8AVQBUAFMAXA"
      $xe3 = "NAEkAQwBSAE8AUwB+ADEAXABXAEUAQgBTAEUAUgB+ADEAXAAxADYAXABUAEUATQBQAEwAQQBUAEUAXABMAEEAWQBPAFUAVABTAFwA"
      // MICROS~1\WEBSER~1\15\TEMPLATE\LAYOUTS\
      $xe4 = "TQBJAEMAUgBPAFMAfgAxAFwAVwBFAEIAUwBFAFIAfgAxAFwAMQA1AFwAVABFAE0AUABMAEEAVABFAFwATABBAFkATwBVAFQAUwBcA"
      $xe5 = "0ASQBDAFIATwBTAH4AMQBcAFcARQBCAFMARQBSAH4AMQBcADEANQBcAFQARQBNAFAATABBAFQARQBcAEwAQQBZAE8AVQBUAFMAXA"
      $xe6 = "NAEkAQwBSAE8AUwB+ADEAXABXAEUAQgBTAEUAUgB+ADEAXAAxADUAXABUAEUATQBQAEwAQQBUAEUAXABMAEEAWQBPAFUAVABTAFwA"
   condition:
      1 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 11 string patterns in its detection logic.

References

• https://research.eye.security/sharepoint-under-siege/
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the SharePoint RCE Vulnerability (CVE-2025-53770) detection rule, including suggested filters and exclusions:

• Scenario: Scheduled SharePoint Health Monitoring & Backup Jobs

  • Context: Enterprise environments often run automated maintenance scripts (e.g., using PowerShell or Azure Automation) that periodically query specific internal endpoints to verify service health or trigger backup routines. These jobs may access the exact URI patterns associated with CVE-2025-53770 as part of their validation logic, mimicking an exploitation attempt.
  • Filter/Exclusion: Exclude traffic originating from known management accounts (e.g., SPN\SharePointBackupService, AzureAD\HealthMonitor) or specific service account IPs (e.g., the IP range of the backup server cluster) during defined maintenance windows (e.g., 02:00–04:00 daily).

• Scenario: Third-Party Integration Webhooks and API Polling

  • Context: External or internal SaaS tools (such as Microsoft Power Automate, ServiceNow, or custom ERP systems) frequently poll SharePoint for data synchronization. If these integrations utilize the specific URI structure targeted by the vulnerability rule to retrieve metadata or trigger workflows, they will generate legitimate hits that resemble an attack vector.
  • Filter/Exclusion: Create a whitelist of trusted source IPs belonging to known integration gateways and exclude requests where the User-Agent header contains identifiers for these tools (e.g., PowerAutomate, ServiceNow-Integration, or specific custom API client names).

• Scenario: Admin-Led Content Migration or Indexing Tasks

  • Context: During large-scale content migrations, database indexing updates, or search crawler runs, administrators often execute high-volume queries against the SharePoint web application