Detects compiled ASPX web shell dropped during the exploitation of SharePoint RCE vulnerability CVE-2025-53770

Hunt Hypothesis

This hunt hypothesis targets adversaries who exploit the SharePoint Remote Code Execution vulnerability (CVE-2025-53770) to deploy compiled ASPX web shells that may evade traditional signature-based detection due to their dynamic nature. Proactive hunting for this behavior in Azure Sentinel is critical because these web shells often serve as a persistent foothold for lateral movement and data exfiltration, requiring immediate investigation before attackers can establish deeper control over the environment.

YARA Rule

rule WEBSHELL_ASPX_Compiled_Sharepoint_Drop_CVE_2025_53770_Jul25_2 {
   meta:
      description = "Detects compiled ASPX web shell dropped during the exploitation of SharePoint RCE vulnerability CVE-2025-53770"
      author = "Florian Roth, Marius Benthin"
      reference = "https://research.eye.security/sharepoint-under-siege/"
      date = "2025-07-20"
      modified = "2025-07-25"
      score = 75
      hash = "8d3d3f3a17d233bc8562765e61f7314ca7a08130ac0fb153ffd091612920b0f2"
      hash = "d8ca5e5d6400ac34ac4cc138efa89d2ec4d5c0e968a78fa3ba5dbc04c7550649"
      hash = "7e9b77da1f51d03ee2f96bc976f6aeb781f801cf633862a4b8c356cbb555927d"
      id = "00a844ab-aede-53bf-820f-d43a5d96426d"
   strings:
      $x1 = /App_Web_spinstall\d{0,1}.aspx/ wide
      $x2 = /spinstall[\w]?[\._]aspx/ ascii
      $x3 = /\/_layouts\/1[0-9]\/spinstall/ wide
      $x4 = /\/_layouts\/1[0-9]\/ghostfile/ wide

      $s1 = "System.Web.Configuration.MachineKeySection" wide
      $s2 = "Page_load" ascii fullword
      $s3 = "GetApplicationConfig" wide fullword
   condition:
      uint16(0) == 0x5a4d
      and filesize < 20KB
      and (
         1 of ($x*)
         or all of ($s*)
      )
      or 2 of ($x*)
      or 4 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

Microsoft Defender for Endpoint — Custom indicators / advanced hunting
Email Gateway — Attachment scanning
File Share Monitoring — Periodic scanning of shared drives
YARA CLI — Manual threat hunting on endpoints

This rule contains 7 string patterns in its detection logic.

References

False Positive Guidance

Here are 4 specific false positive scenarios for the Detects compiled ASPX web shell dropped during the exploitation of SharePoint RCE vulnerability CVE-2025-53770 rule, including suggested filters and exclusions:

Scheduled Backup or Migration Tasks via PowerShell
- Scenario: Automated nightly scripts using PowerShell or SharePoint Management Shell (SPShell) execute commands to migrate content or update site configurations. These scripts often invoke the .NET compiler (csc.exe) to generate temporary compiled .aspx components within the SharePoint web root directory as part of the deployment pipeline, mimicking the behavior of an attacker dropping a shell.
- Filter/Exclusion: Exclude alerts where the parent process is powershell.exe or wssadmin.exe and the user context belongs to the SPFarmAdmins group or specific service accounts (e.g., DOMAIN\SharePointSvc). Additionally, filter based on file path patterns that include known staging directories like \WSS\VirtualDirectories\<SiteID>\_temp.
Third-Party Analytics or Reporting Tool Deployment
- Scenario: Enterprise analytics platforms such as Microsoft Power BI Report Server or Tableau Server, which integrate with SharePoint, periodically deploy custom reporting dashboards. During these updates, the tools compile new .aspx report pages directly into the SharePoint IIS application pool directory to ensure immediate user access, triggering the “compiled web shell” detection logic.
- Filter/Exclusion: Create an exclusion rule for files dropped by processes named mscorsvw.exe, w3wp.exe (specifically those running under the AppPoolName: SharePoint-Reporting), or specific third-party agents like PowerBI-Agent. Filter out events where the file hash matches a known baseline of legitimate reporting components.
**Automated Content Scanning by