CISA Warning: Active Exploitation of Critical SharePoint RCE Flaw

---
title: SharePoint RCE - Suspicious Process Spawn by w3wp.exe
id: a1b2c3d4-5678-90ab-cdef-1234567890ab
status: experimental
description: Detects potential exploitation of SharePoint RCE via IIS worker process spawning a command shell or PowerShell. 
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
author: Security Arsenal
date: 2026/05/21
tags:
  - attack.initial_access
  - attack.t1190
  - attack.execution
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: '\w3wp.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
  condition: selection
falsepositives:
  - Legitimate administrative scripts (rare for w3wp to spawn these directly)
level: high
---
title: SharePoint Web Shell Indicator - ASPX File Creation
id: b2c3d4e5-6789-01ab-cdef-234567890bcd
status: experimental
description: Detects creation of new ASPX files in SharePoint directories, a common method for web shell persistence.
references:
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/05/21
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: file_creation
  product: windows
detection:
  selection:
    TargetFilename|contains:
      - '\inetpub\wwwroot\'
      - '\_layouts\'
      - '\_vti_bin\'
    TargetFilename|endswith: '.aspx'
  filter:
    User|contains:
      - 'AUTHORI'
      - 'ADMIN'
  condition: selection and not filter
falsepositives:
  - Legitimate SharePoint deployment or custom development updates
level: medium

// Hunt for suspicious child processes of IIS worker process (w3wp.exe)
// indicative of web shell or RCE activity
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where InitiatingProcessFileName == "w3wp.exe"
| where FileName in~ ("powershell.exe", "cmd.exe", "cscript.exe", "wscript.exe", "powershell_ise.exe")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessId, FolderPath
| order by Timestamp desc

-- Hunt for w3wp.exe spawning command interpreters
SELECT Pid, Name, CommandLine, Exe, Username, StartTime
FROM pslist()
WHERE ParentName =~ 'w3wp.exe'
  AND Name IN ('cmd.exe', 'powershell.exe', 'pwsh.exe')

<#
.SYNOPSIS
    SharePoint Server Health Check for May 2026 RCE Patch.
.DESCRIPTION
    This script assists in identifying the SharePoint Build Version to verify
    if the May 2026 security updates have been applied.
    Note: Defenders must verify the build version against the specific
    Security Advisory released in May 2026.
#>

Write-Host "Checking SharePoint Farm Build Version..." -ForegroundColor Cyan

try {
    # Check if SharePoint Snapin or Module is available
    if (Get-PSSnapin -Registered -Name Microsoft.SharePoint.PowerShell -ErrorAction SilentlyContinue) {
        Add-PSSnapin Microsoft.SharePoint.PowerShell -ErrorAction Stop
        
        $farm = Get-SPFarm
        $build = $farm.BuildVersion
        
        Write-Host "Current SharePoint Build Version: $($build)" -ForegroundColor Yellow
        Write-Host " "
        Write-Host "ACTION REQUIRED:" -ForegroundColor Red
        Write-Host "Please compare the output above against the May 2026 Security Update Advisory." 
        Write-Host "If the build version is older than the May 2026 update, you are vulnerable." 
    }
    else {
        Write-Warning "Microsoft.SharePoint.PowerShell snapin not found on this machine."
        Write-Host "Please run this script directly on a SharePoint Front-End server."
    }
}
catch {
    Write-Error "An error occurred: $_"
}