CVE-2026-63520: Microsoft SharePoint Unauthenticated RCE Chained with CVE-2026-55040 — Detection and Remediation Guide

---
title: IIS Worker Process Spawning Command Shell or Scripting Engine
description: Detects w3wp.exe spawning cmd.exe, powershell.exe, or other LOLBins — a hallmark of web server RCE exploitation including SharePoint exploit chains such as CVE-2026-63520.
id: 3f8a2c14-7b51-4e9a-9c2d-5e6f7a8b9c0d
status: experimental
references:
  - https://www.rapid7.com/blog/post/etr-cve-2026-63520-microsoft-sharepoint-remote-code-execution-fixed
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059
  - attack.initial_access
  - attack.t1190
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\w3wp.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\powershell_ise.exe'
      - '\pwsh.exe'
      - '\cscript.exe'
      - '\wscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
      - '\curl.exe'
      - '\wget.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare — some legacy SharePoint solutions and custom timer jobs may legitimately spawn processes. Baseline per farm before tuning.
level: high
---
title: File Creation in SharePoint Web-Accessible Directories by IIS Worker Process
description: Detects w3wp.exe writing executable or script content into SharePoint LAYOUTS/TEMPLATE or inetpub directories — consistent with web shell deployment following exploitation of a SharePoint RCE such as CVE-2026-63520.
id: 9d4e1b72-2a63-4f8c-b1a7-3c5d6e7f8a9b
status: experimental
references:
  - https://www.rapid7.com/blog/post/etr-cve-2026-63520-microsoft-sharepoint-remote-code-execution-fixed
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: file_event
  product: windows
detection:
  selection_image:
    Image|endswith: '\w3wp.exe'
  selection_path:
    TargetFilename|contains:
      - '\LAYOUTS\'
      - '\TEMPLATE\'
      - '\inetpub\'
      - '\wwwroot\'
  selection_ext:
    TargetFilename|endswith:
      - '.aspx'
      - '.ashx'
      - '.asmx'
      - '.asp'
      - '.php'
      - '.exe'
      - '.dll'
      - '.ps1'
      - '.bat'
  condition: selection_image and selection_path and selection_ext
falsepositives:
  - SharePoint cumulative update installation and solution (WSP) deployment during maintenance windows. Correlate with change windows.
level: high
---
title: Suspicious Encoded PowerShell Execution on SharePoint Server
description: Detects encoded or obfuscated PowerShell command lines on systems running SharePoint — common post-exploitation tradecraft after gaining code execution via a web-facing vulnerability.
id: 5b2c9d81-6e47-4a3f-8d1c-2e4f5a6b7c8d
status: experimental
references:
  - https://attack.mitre.org/techniques/T1027/
  - https://attack.mitre.org/techniques/T1059/001/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.defense_evasion
  - attack.t1027
  - attack.execution
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
  selection_cli:
    CommandLine|contains:
      - ' -enc '
      - ' -ec '
      - ' -EncodedCommand'
      - 'FromBase64String'
      - 'IEX'
      - 'Invoke-Expression'
      - 'DownloadString'
      - 'Net.WebClient'
  filter_sp_mgmt:
    CommandLine|contains:
      - 'Microsoft.SharePoint'
      - 'stsadm'
  condition: selection_img and selection_cli and not filter_sp_mgmt
falsepositives:
  - Some enterprise management tooling (SCCM, monitoring agents) uses encoded commands. Allow-list known management accounts and hosts.
level: medium

// Hunt for SharePoint/IIS exploitation behavior — CVE-2026-63520 chain aftermath
// Part 1: w3wp spawning shells or LOLBins
let SuspiciousChildren = dynamic(["cmd.exe", "powershell.exe", "pwsh.exe", "cscript.exe", "wscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe", "certutil.exe", "bitsadmin.exe", "curl.exe", "whoami.exe", "net.exe", "nltest.exe"]);
DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName =~ "w3wp.exe"
| where FileName in~ (SuspiciousChildren)
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessCommandLine, AccountName, SHA256
| order by TimeGenerated desc;
// Part 2: Executable/script file drops into SharePoint web directories by IIS
DeviceFileEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName =~ "w3wp.exe"
| where FolderPath has_any ("\\LAYOUTS\\", "\\TEMPLATE\\", "\\inetpub\\", "\\wwwroot\\")
| where FileName endswith_any (".aspx", ".ashx", ".asmx", ".asp", ".exe", ".dll", ".ps1", ".bat")
| project TimeGenerated, DeviceName, FileName, FolderPath, InitiatingProcessCommandLine, SHA256
| order by TimeGenerated desc;
// Part 3: Anomalous outbound connections from w3wp (exclude typical Microsoft/SQL destinations after baselining)
DeviceNetworkEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName =~ "w3wp.exe"
| where RemoteIPType == "Public"
| summarize ConnectionCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by DeviceName, RemoteIP, RemoteUrl, RemotePort
| order by ConnectionCount asc

-- Hunt SharePoint servers for web shell artifacts and w3wp-spawned processes
-- CVE-2026-63520 / CVE-2026-55040 exploitation aftermath

-- Part 1: Suspicious processes spawned by the IIS worker process
SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)(powershell|cmd\.exe|mshta|rundll32|certutil|bitsadmin)'
  AND Username =~ '(?i)(IIS APPPOOL|NETWORK SERVICE)'

-- Part 2: Recently written executable/script files in SharePoint web directories
SELECT FullPath, Size, Mtime, Ctime
FROM glob(globs=[
  'C:/Program Files/Common Files/Microsoft Shared/Web Server Extensions/*/TEMPLATE/LAYOUTS/**/*.aspx',
  'C:/Program Files/Common Files/Microsoft Shared/Web Server Extensions/*/TEMPLATE/LAYOUTS/**/*.ashx',
  'C:/inetpub/wwwroot/**/*.aspx',
  'C:/inetpub/**/*.exe'
])
WHERE Mtime > now() - 1209600
ORDER BY Mtime DESC

-- Part 3: Active outbound connections from w3wp.exe
SELECT Pid, Name, Path, Status,
       Laddr.IP AS LocalIP, Laddr.Port AS LocalPort,
       Raddr.IP AS RemoteIP, Raddr.Port AS RemotePort
FROM netstat()
WHERE Name =~ '(?i)w3wp'
  AND Status =~ 'ESTAB'
  AND NOT RemoteIP =~ '^(10\\.|172\\.(1[6-9]|2[0-9]|3[01])\\.|192\\.168\\.|127\\.)'

# CVE-2026-63520 / CVE-2026-55040 — SharePoint patch verification and compromise sweep
# Run elevated on each SharePoint server in the farm.

# --- 1. Identify installed SharePoint product and build ---
Write-Host "[*] Enumerating installed SharePoint products..." -ForegroundColor Cyan
Get-ItemProperty HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\* |
  Where-Object { $_.DisplayName -match 'SharePoint' } |
  Select-Object DisplayName, DisplayVersion, InstallDate | Format-Table -AutoSize

# --- 2. Pull SharePoint farm build version (requires SharePoint snapin) ---
Write-Host "[*] Querying farm build version..." -ForegroundColor Cyan
try {
  Add-PSSnapin Microsoft.SharePoint.PowerShell -ErrorAction Stop
  (Get-SPFarm).BuildVersion
  Get-SPProduct -Local | Select-Object ProductName, InstallStatus
} catch {
  Write-Warning "SharePoint snapin unavailable — verify build manually via Central Admin > Servers in Farm."
}
Write-Host "[!] ACTION: Compare the build above against the security update table in Microsoft's CVE-2026-63520 advisory (https://msrc.microsoft.com). If below the patched build, apply the update immediately." -ForegroundColor Yellow

# --- 3. Sweep for web shells / suspicious files dropped in the last 30 days ---
Write-Host "[*] Sweeping web-accessible directories for recently dropped executables/scripts..." -ForegroundColor Cyan
$since = (Get-Date).AddDays(-30)
$paths = @(
  "C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions",
  "C:\inetpub"
)
foreach ($p in $paths) {
  if (Test-Path $p) {
    Get-ChildItem -Path $p -Recurse -Include *.aspx,*.ashx,*.asmx,*.asp,*.exe,*.ps1,*.bat -ErrorAction SilentlyContinue |
      Where-Object { $_.LastWriteTime -gt $since } |
      Select-Object FullName, LastWriteTime, Length | Format-Table -AutoSize
  }
}

# --- 4. Check for w3wp spawning suspicious child processes (last 14 days of event log) ---
Write-Host "[*] Checking process creation events for w3wp spawning shells (requires Audit Process Creation + cmdline logging)..." -ForegroundColor Cyan
Get-WinEvent -FilterHashtable @{ LogName='Security'; Id=4688; StartTime=(Get-Date).AddDays(-14) } -ErrorAction SilentlyContinue |
  Where-Object { $_.Message -match 'w3wp\.exe' -and $_.Message -match '(cmd\.exe|powershell|mshta|rundll32|certutil)' } |
  Select-Object TimeCreated, Message -First 25 | Format-List

# --- 5. Verify outbound exposure ---
Write-Host "[*] Listing IIS site bindings — confirm SharePoint is NOT unintentionally internet-facing..." -ForegroundColor Cyan
Import-Module WebAdministration -ErrorAction SilentlyContinue
Get-Website | Select-Object Name, State, @{N='Bindings';E={ ($_.Bindings.Collection | ForEach-Object { $_.bindingInformation }) -join '; ' }} | Format-Table -AutoSize

Write-Host "[*] Done. Any file/process hits above warrant immediate IR triage." -ForegroundColor Green