Microsoft SharePoint RCE Chain Under Active Attack: Detection and Remediation Guide for On-Premises Servers

---
title: SharePoint IIS Worker Process Spawning Command Shell or Scripting Engine
id: 3f9c1a72-5e84-4b21-9d6a-2c7f8e4a1b93
status: experimental
description: Detects the SharePoint/IIS worker process (w3wp.exe) spawning command shells, PowerShell, or other scripting engines — a hallmark of successful RCE exploitation against SharePoint Server. The SharePoint application pool process does not legitimately launch these interpreters in normal operations.
references:
  - https://www.bleepingcomputer.com/news/security/hackers-target-microsoft-sharepoint-rce-chain-with-poc-exploit/
  - https://attack.mitre.org/techniques/T1190/
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/02/10
tags:
  - attack.initial_access
  - attack.t1190
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\w3wp.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\cscript.exe'
      - '\wscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
      - '\net.exe'
      - '\net1.exe'
      - '\whoami.exe'
      - '\nltest.exe'
      - '\ipconfig.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare third-party SharePoint solutions or custom timer jobs that shell out — investigate and whitelist by exact command line, never by parent alone
level: critical
---
title: ASPX Webshell Dropped in SharePoint LAYOUTS Directory
id: 8b2e4d61-7c93-4a58-bf21-9e3d6c5a7042
status: experimental
description: Detects creation or modification of ASPX files in the SharePoint LAYOUTS directory by the IIS worker process or other non-installer processes. Post-exploitation of the SharePoint RCE chain commonly drops a webshell (e.g., filenames mimicking legitimate components such as spinstall0.aspx) into this path for persistent unauthenticated access.
references:
  - https://www.bleepingcomputer.com/news/security/hackers-target-microsoft-sharepoint-rce-chain-with-poc-exploit/
  - https://attack.mitre.org/techniques/T1505.003/
author: Security Arsenal
date: 2026/02/10
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: file_event
  product: windows
detection:
  selection_path:
    TargetFilename|contains:
      - '\_layouts\15\'
      - '\_layouts\16\'
  selection_ext:
    TargetFilename|endswith:
      - '.aspx'
      - '.ashx'
      - '.asmx'
  filter_installers:
    Image|endswith:
      - '\msiexec.exe'
      - '\setup.exe'
      - '\psconfig.exe'
      - '\psconfigui.exe'
  condition: selection_path and selection_ext and not filter_installers
falsepositives:
  - Legitimate SharePoint cumulative update installation or solution deployment — correlate with approved change windows
level: high

// Hunt: SharePoint RCE post-exploitation — w3wp.exe spawning suspicious child processes
// Scope to your SharePoint farm servers; extend the lookback to cover your patch gap window.
let Lookback = 30d;
let SharePointServers = dynamic(["SPSERVER01", "SPSERVER02"]); // TODO: replace with your farm hostnames or use a watchlist
DeviceProcessEvents
| where TimeGenerated >= ago(Lookback)
| where DeviceName has_any (SharePointServers)
| where InitiatingProcessFileName =~ "w3wp.exe"
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "cscript.exe", "wscript.exe",
    "mshta.exe", "rundll32.exe", "regsvr32.exe", "certutil.exe", "bitsadmin.exe",
    "net.exe", "net1.exe", "whoami.exe", "nltest.exe", "ipconfig.exe", "vssadmin.exe", "wevtutil.exe")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine,
          InitiatingProcessCommandLine, SHA256, ReportId
| order by TimeGenerated asc;

// Hunt: Suspicious requests to SharePoint administrative endpoints (ingest IIS W3C logs via AMA/CEF)
// Look for unauthenticated POSTs to ToolPane.aspx and requests for unknown .aspx under _layouts.
CommonSecurityLog
| where TimeGenerated >= ago(Lookback)
| where RequestURL has_any ("/_layouts/15/ToolPane.aspx", "/_layouts/16/ToolPane.aspx")
    or (RequestURL has "/_layouts/" and RequestURL endswith ".aspx" and RequestMethod == "POST")
| summarize Hits = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
    by SourceIP, RequestURL, RequestMethod, DestinationHostName
| order by Hits desc;

-- Hunt SharePoint farm servers for webshell artifacts and RCE process chains
-- 1) Recently created/modified ASPX/ASHX files under the LAYOUTS directories
SELECT FullPath, Size, Mtime, Ctime, Btime
FROM glob(globs=[
  'C:/Program Files/Common Files/microsoft shared/Web Server Extensions/*/TEMPLATE/LAYOUTS/*.aspx',
  'C:/Program Files/Common Files/microsoft shared/Web Server Extensions/*/TEMPLATE/LAYOUTS/*.ashx',
  'C:/inetpub/wwwroot/wss/VirtualDirectories/*/_layouts/*/*.aspx'
])
WHERE Mtime > now() - 2592000  -- last 30 days; widen to cover your exposure window
ORDER BY Mtime DESC

-- 2) IIS worker processes with suspicious command-line ancestry or loaded temp-path executables
SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ 'w3wp'
   OR CommandLine =~ 'spinstall0|_layouts.*aspx|ViewState|MachineKey'

# Run elevated on each SharePoint farm server
# 1) Report installed SharePoint build — compare against the latest build at
#    https://learn.microsoft.com/en-us/officeupdates/sharepoint-updates
$sp = Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Shared Tools\Web Server Extensions\*\WSS" -ErrorAction SilentlyContinue
$sp | Select-Object PSChildName, Version

# 2) Check for pending security updates applicable to SharePoint
$Session = New-Object -ComObject Microsoft.Update.Session
$Searcher = $Session.CreateUpdateSearcher()
$Searcher.Search("IsInstalled=0").Updates |
  Where-Object { $_.Title -match 'SharePoint' } |
  Select-Object Title, IsDownloaded

# 3) Sweep LAYOUTS directories for recently modified script files (webshell triage)
$cutoff = (Get-Date).AddDays(-45)
$roots = @(
  "C:\Program Files\Common Files\microsoft shared\Web Server Extensions",
  "C:\inetpub\wwwroot\wss\VirtualDirectories"
)
foreach ($root in $roots) {
  if (Test-Path $root) {
    Get-ChildItem -Path $root -Recurse -Include *.aspx,*.ashx,*.asmx -ErrorAction SilentlyContinue |
      Where-Object { $_.LastWriteTime -gt $cutoff -and $_.FullName -match '_layouts' } |
      Select-Object FullName, LastWriteTime, Length
  }
}

# 4) Confirm AMSI is functional on the host (antimalware provider registered)
Get-MpComputerStatus | Select-Object AMServiceEnabled, AMRunningMode, RealTimeProtectionEnabled, AntivirusSignatureLastUpdated

# 5) List w3wp child processes spawned in the last 7 days from the security event log (4688 with command line auditing enabled)
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688; StartTime=(Get-Date).AddDays(-7)} -ErrorAction SilentlyContinue |
  Where-Object { $_.Message -match 'w3wp\.exe' -and $_.Message -match 'cmd\.exe|powershell\.exe|certutil\.exe|mshta\.exe' } |
  Select-Object TimeCreated, Message -First 50