Detects ASPX web shell dropped during the exploitation of SharePoint RCE vulnerability CVE-2025-53770

Hunt Hypothesis

This hunt hypothesis targets adversaries who exploit the SharePoint Remote Code Execution vulnerability (CVE-2025-53770) to deploy ASPX web shells for persistent remote access and command execution. Proactive hunting is essential in Azure Sentinel to immediately identify these stealthy artifacts, enabling rapid containment before attackers can establish a foothold or escalate privileges within the organization’s SharePoint infrastructure.

YARA Rule

rule WEBSHELL_ASPX_Sharepoint_Drop_CVE_2025_53770_Jul25 {
   meta:
      description = "Detects ASPX web shell dropped during the exploitation of SharePoint RCE vulnerability CVE-2025-53770"
      author = "Florian Roth"
      reference = "https://research.eye.security/sharepoint-under-siege/"
      date = "2025-07-20"
      score = 80
      hash = "27c45b8ed7b8a7e5fff473b50c24028bd028a9fe8e25e5cea2bf5e676e531014"
      hash = "92bb4ddb98eeaf11fc15bb32e71d0a63256a0ed826a03ba293ce3a8bf057a514"
      hash = "b336f936be13b3d01a8544ea3906193608022b40c28dd8f1f281e361c9b64e93"
      id = "f1c8f671-a0d2-5aaf-93f4-025dace0dbe1"
   strings:
      $x1 = "var sy = System.Reflection.Assembly.Load(" ascii
      $x2 = "Response.Write(cg.ValidationKey+" ascii

      $s1 = "<script runat=\"server\" language=\"c#\" CODEPAGE=\"65001\">" ascii fullword
   condition:
      filesize < 4KB
      and 1 of ($x*)
      or all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 3 string patterns in its detection logic.

References

• https://research.eye.security/sharepoint-under-siege/
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Detects ASPX web shell dropped during the exploitation of SharePoint RCE vulnerability CVE-2025-53770 rule, including suggested filters and exclusions:

• Scheduled Backup or Migration Tasks by Third-Party Tools

  • Scenario: Enterprise backup solutions (e.g., Veeam, Rubrik) or migration tools (e.g., SharePoint Migration Tool) periodically create temporary .aspx files in the SharePoint content directories to verify connectivity or stage data before full deployment. These legitimate artifacts mimic the file creation behavior of a web shell.
  • Filter/Exclusion: Exclude alerts where the parent process is VeeamTransport.exe, RubrikAgent.exe, or SPMT.exe. Additionally, filter out events where the .aspx filename contains specific patterns like _temp_, _backup_, or includes a timestamp suffix (e.g., Report_20250120.aspx).

• Automated Deployment via CI/CD Pipelines

  • Scenario: DevOps teams utilize Azure DevOps, GitHub Actions, or Jenkins pipelines to push new web parts, custom forms, or dashboard updates to the SharePoint farm. These automated agents often drop new .aspx files into the wss\Layouts or _layouts directories during routine release windows.
  • Filter/Exclusion: Create an exclusion for events occurring within defined “Maintenance Windows” (e.g., Sundays 02:00–04:00 UTC). Furthermore, filter out alerts where the user context is a dedicated service account named svc-sharepoint-deploy or ci-cd-agent, and the file path resides strictly within known deployment folders like \15\Layouts.

• **Manual Administrative Updates by SharePoint Farm Administr