Incident Micro-Postmortem — Microsoft SharePoint (On-Prem) “ToolShell” Campaign

This kit triages the mid-2025 “ToolShell” zero-day campaign against on-premises Microsoft SharePoint Server; SharePoint Online is out of scope. It delivers end-to-end reproducible hunts, comms, and figures without relying on external data.

Why this repo exists: accelerate analyst triage with reproducible detections and aligned executive communications.

Scope and Assumptions

• On-prem Microsoft SharePoint Server only.
• Likely attack flow: internet-exposed SharePoint/IIS → crafted deserialization/ViewState abuse → webshell deployment → potential machineKey/ValidationKey theft → token forgery → RCE/lateral movement.
• Synthetic, illustrative data only; no real organizational telemetry or proprietary IOCs.

ATT&CK Snapshot

Techniques emphasized: T1190 (Exploit Public-Facing Application), T1059.001 (PowerShell), T1505.003 (Web Shell), T1078 (Valid Accounts), T1027 (Obfuscated/Complicated Files), T1003 (OS Credential Dumping), T1082 (System Information Discovery), T1021 (Remote Services), T1071 (Application Layer Protocol), T1567 (Exfiltration Over Web Services).

Logs That Matter (Table)

Run These Hunts Now

• hunts/w3wp_powershell_encodedcommand.kql · SPL · Sigma: Catch encoded PowerShell spawned from IIS worker.
• hunts/sharepoint_webshell_filecreate.kql · SPL · Sigma: Identify unexpected .aspx files within SharePoint web roots.
• hunts/dns_newly_seen_post_iis_anomaly.kql · · : Surface low-prevalence DNS domains following IIS anomalies and suspicious IIS child processes.

How To Reproduce On This Repo

• Review samples/example_events.json for representative Windows Security 4688, Sysmon 11, and DNS entries aligned to each hunt (benign noise included).
• Expected outputs (abridged):
  • PowerShell spawn hunt: Account of the app pool service account, CommandLine containing -enc, with 3 malicious hits and 1 benign admin script note.
  • Webshell file create hunt: aggregation showing 2 .aspx paths under \inetpub\wwwroot\wss\VirtualDirectories\80\Layouts\ during the attack hour and a benign deployment entry.
  • DNS newly-seen hunt: domains cdn-msupdate.example, toolshare-sync.example tied to the IIS host IP with <5 total queries in 24h plus one benign corporate CDN domain ignored by thresholding.
• False-positive tuning: align allowlists to documented admin automation windows, deployment change tickets, known CDN domains, and scripted maintenance tasks. Adjust time bins and prevalence thresholds based on platform norms; track service account behavior via baseline comparisons.

First 4 Hours — Comms Plan

• See comms/first_4h.md for ready-to-send templates and placeholders.
• Cadence: T+0–30 triage notification (stakeholders aligned), T+30–120 hourly scoping stand-ups, T+120–240 containment status plus executive brief aligned to the decision tree.
• Decision tree visual: figures/decision-tree.png mirrors the ASCII logic in the comms pack.

Falsifiability and Limitations

• If IIS app pool automation legitimately launches PowerShell with encoded scripts (e.g., DevOps tooling), the PowerShell hunt will trigger; maintain maintenance allowlists and track known automation accounts.
• Rapid attacker cleanup or alternative tooling (e.g., unmanaged CLR webshells, C# assemblies) may evade file creation telemetry, especially if Sysmon coverage is incomplete or tamper-prone.

Future Work (Optional)

• AppSec guardrails for SharePoint-adjacent apps: secret scanning for machine keys, CI checks for dangerous deserialization patterns, and web-root integrity monitoring during build pipelines.

Sources (Non-quoted, general references)

• Microsoft security guidance (on-prem scope): https://www.microsoft.com/en-us/msrc/blog/2025/07/customer-guidance-for-sharepoint-vulnerability-cve-2025-53770
• NVD CVE (mid-2025 SharePoint on-prem): https://nvd.nist.gov/vuln/detail/CVE-2025-53770
• CISA advisory/MAR (mid-2025 SharePoint): https://www.cisa.gov/news-events/analysis-reports/ar25-218a

Vendor research:

• Unit 42 — https://unit42.paloaltonetworks.com/microsoft-sharepoint-cve-2025-49704-cve-2025-49706-cve-2025-53770/
• SentinelOne — https://www.sentinelone.com/blog/sharepoint-toolshell-zero-day-exploited-in-the-wild-targets-enterprise-servers/
• Trend Micro — https://www.trendmicro.com/en_us/research.html (search: “SharePoint ToolShell CVE-2025-53770”)

After-Build Notes — How to Adapt to Live SIEM/EDR

• Update index/table names (index=*, SecurityEvent, Sysmon) to match local data models (e.g., m365:security, wineventlog).
• Replace placeholder fields (Account, ClientIP, TargetFilename) with environment-specific aliases or normalized schemas (e.g., user, ip_src, file_path).
• Confirm timezone alignment; adjust ago(24h) or earliest windows to match fleet retention and detection latency.
• Embed environment-specific allowlists (service accounts, deployment hosts) to reduce noise while preserving attacker coverage.