📂 Affected Products

📡 Exploitation Indicators

• Upload of spinstall0.aspx or similar shell files.

• Requests to:

  • /sites/*/_layouts/15/ToolPane.aspx?DisplayMode=Edit
  • With referrer: _layouts/SignOut.aspx

• w3wp.exe spawning cmd.exe, powershell.exe, or rundll32.

🧪 Detection Tips

Web Logs:

• Look for unusual POST requests to SharePoint layout pages.
• Search for access logs involving /layouts/ with uncommon user agents.

File System:

• Scan for unrecognized .aspx files in:

  • %ProgramFiles%\Common Files\Microsoft Shared\Web Server Extensions\15\TEMPLATE\LAYOUTS\

Processes:

• Monitor for anomalous child processes under w3wp.exe.

Network:

• Detect outbound connections to known attacker IPs:

  • 107.191.58.76, 96.9.125.147, 104.238.159.149

🔐 Mitigation

Before Patch:

1. Enable AMSI:

   • Use Microsoft Defender Antivirus with AMSI support.
   • AMSI can detect malicious ViewState payloads before execution.

2. Apply Network Controls:

   • Restrict SharePoint server access to internal networks only.

3. Deploy EDR/XDR:

   • Use Defender for Endpoint or similar for behavioral detection.

After Patch:

1. Install July 2025 Updates:

   • Microsoft released hotfixes for SharePoint 2016, 2019, and Subscription Edition.

2. Rotate machineKey:

   • Change ASP.NET ValidationKey and DecryptionKey in web.config.
   • Force restart of IIS (iisreset) to apply changes.

3. Audit & Cleanup:

   • Remove rogue .aspx files.
   • Check for scheduled tasks or persistence mechanisms.

🛡️ Summary

• A high-impact zero-day in SharePoint allows full server compromise via forged ViewState payloads.
• Active exploitation confirmed.
• Patch immediately, rotate encryption keys, and scan for compromise indicators.