Microsoft SharePoint Unauthenticated RCE Now Weaponized by Ransomware Gangs — Detection, Hunting, and Remediation Guide

---
title: SharePoint IIS Worker Process Spawning Command Shell
id: 9b2e4f61-3c8a-4d71-b5e2-7f0a1c9d4e6b
status: experimental
description: Detects the SharePoint IIS worker process (w3wp.exe) spawning command interpreters or scripting engines, consistent with webshell activity following exploitation of the unauthenticated SharePoint RCE flagged by CISA as actively exploited since July 2025.
references:
  - https://www.bleepingcomputer.com/news/security/cisa-microsoft-sharepoint-flaw-now-exploited-in-ransomware-attacks/
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.persistence
  - attack.t1505.003
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\w3wp.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\powershell_ise.exe'
      - '\pwsh.exe'
      - '\cscript.exe'
      - '\wscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\wmic.exe'
      - '\vssadmin.exe'
      - '\net.exe'
      - '\net1.exe'
      - '\whoami.exe'
      - '\nltest.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare legitimate SharePoint admin tooling; verify against change windows and administrator accounts
level: high
---
title: Webshell Dropped in SharePoint LAYOUTS Directory
id: 4d7a8c20-1e5b-4f93-a6d8-2b9c3e7f5a01
status: experimental
description: Detects creation or modification of ASPX/ASP files in the SharePoint TEMPLATE LAYOUTS directory by non-standard processes, matching webshell deployment tradecraft (e.g., spinstall0.aspx-style artifacts) observed in the actively exploited SharePoint campaign.
references:
  - https://www.bleepingcomputer.com/news/security/cisa-microsoft-sharepoint-flaw-now-exploited-in-ransomware-attacks/
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: file_event
  product: windows
detection:
  selection_path:
    TargetFilename|contains:
      - '\Web Server Extensions\15\TEMPLATE\LAYOUTS\'
      - '\Web Server Extensions\16\TEMPLATE\LAYOUTS\'
  selection_ext:
    TargetFilename|endswith:
      - '.aspx'
      - '.asp'
      - '.ashx'
      - '.asmx'
  condition: selection_path and selection_ext
falsepositives:
  - Legitimate SharePoint solution deployments during maintenance windows; correlate with change tickets
level: critical
---
title: Shadow Copy Deletion Preceding Ransomware Encryption
id: 6f1c9b34-8d2e-4a67-c3f5-9e0b4d8a2c17
status: experimental
description: Detects deletion or resizing of Volume Shadow Copies, a near-universal precursor to ransomware encryption activity, as seen in encryption-based attacks leveraging the SharePoint intrusion vector.
references:
  - https://www.bleepingcomputer.com/news/security/cisa-microsoft-sharepoint-flaw-now-exploited-in-ransomware-attacks/
  - https://attack.mitre.org/techniques/T1490/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.impact
  - attack.t1490
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains:
      - 'vssadmin delete shadows'
      - 'vssadmin resize shadowstorage'
      - 'wmic shadowcopy delete'
      - 'bcdedit'
      - 'wbadmin delete catalog'
      - 'wbadmin delete systemstatebackup'
  condition: selection
falsepositives:
  - Legitimate backup maintenance scripts; rare in production
level: high

let Lookback = 30d;
let SharePointProcs = dynamic(["cmd.exe","powershell.exe","pwsh.exe","net.exe","net1.exe","whoami.exe","nltest.exe","ipconfig.exe","wmic.exe","vssadmin.exe","certutil.exe","bitsadmin.exe","mshta.exe","rundll32.exe","regsvr32.exe"]);
union
(DeviceProcessEvents
| where TimeGenerated >= Lookback
| where InitiatingProcessFileName =~ "w3wp.exe"
| where FileName in~ (SharePointProcs)
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, InitiatingProcessId, ReportId
| extend Hunt = "SharePoint w3wp child process"),
(DeviceFileEvents
| where TimeGenerated >= Lookback
| where FolderPath has_any (@"\Web Server Extensions\15\TEMPLATE\LAYOUTS\", @"\Web Server Extensions\16\TEMPLATE\LAYOUTS\")
| where FileName endswith ".aspx" or FileName endswith ".ashx" or FileName endswith ".asmx"
| project TimeGenerated, DeviceName, FileName, FolderPath, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256, ReportId
| extend Hunt = "ASPX write in LAYOUTS")
| order by TimeGenerated desc

let Lookback = 14d;
CommonSecurityLog
| where TimeGenerated >= Lookback
| where RequestURL has_any ("/_layouts/", "/_vti_bin/", "/_api/")
| where RequestMethod =~ "POST"
| where SourceIP !startswith "10." and SourceIP !startswith "192.168." and SourceIP !startswith "172.16."
| summarize Hits = count(), DistinctURIs = dcount(RequestURL), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, DestinationHostName
| where Hits > 50 or DistinctURIs > 10
| order by Hits desc

-- SharePoint compromise hunt: webshell artifacts in LAYOUTS + w3wp child processes
LET webshells = SELECT FullPath, Size, Mtime, Btime, hash(path=FullPath).SHA256 AS SHA256
FROM glob(globs=[
  'C:/Program Files/Common Files/Microsoft Shared/Web Server Extensions/15/TEMPLATE/LAYOUTS/*.aspx',
  'C:/Program Files/Common Files/Microsoft Shared/Web Server Extensions/16/TEMPLATE/LAYOUTS/*.aspx',
  'C:/Program Files/Common Files/Microsoft Shared/Web Server Extensions/15/TEMPLATE/LAYOUTS/**/*.ashx',
  'C:/Program Files/Common Files/Microsoft Shared/Web Server Extensions/16/TEMPLATE/LAYOUTS/**/*.ashx'
])
WHERE Mtime > parse(time='2025-07-01T00:00:00Z')
ORDER BY Mtime DESC

LET children = SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Ppid IN (SELECT Pid FROM pslist() WHERE Name =~ 'w3wp')
  AND Name =~ 'cmd|powershell|pwsh|net|whoami|nltest|wmic|vssadmin|certutil|mshta'

SELECT * FROM webshells
UNION ALL
SELECT * FROM children

# SharePoint compromise verification - run elevated on each SharePoint server
$ErrorActionPreference = 'SilentlyContinue'
$since = Get-Date '2025-07-01'

Write-Host "=== [1] ASPX/ASHX files in LAYOUTS modified since July 2025 ===" -ForegroundColor Cyan
$layouts = @(
  "$env:CommonProgramFiles\Microsoft Shared\Web Server Extensions\15\TEMPLATE\LAYOUTS",
  "$env:CommonProgramFiles\Microsoft Shared\Web Server Extensions\16\TEMPLATE\LAYOUTS"
)
foreach ($path in $layouts) {
  if (Test-Path $path) {
    Get-ChildItem -Path $path -Recurse -Include *.aspx,*.ashx,*.asmx |
      Where-Object { $_.LastWriteTime -gt $since } |
      Select-Object FullName, LastWriteTime, Length,
        @{N='SHA256';E={(Get-FileHash $_.FullName -Algorithm SHA256).Hash}} |
      Format-List
  }
}

Write-Host "=== [2] w3wp.exe spawning shells (Sysmon EID 1 / Security EID 4688) ===" -ForegroundColor Cyan
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688; StartTime=(Get-Date).AddDays(-30)} |
  Where-Object { $_.Message -match 'w3wp\.exe' -or ($_.Message -match 'w3wp\.exe' -and $_.Message -match 'cmd\.exe|powershell\.exe|net\.exe|whoami\.exe|vssadmin\.exe') } |
  Select-Object TimeCreated, Message -First 25 | Format-List

Write-Host "=== [3] Installed SharePoint security updates ===" -ForegroundColor Cyan
Get-HotFix | Where-Object { $_.InstalledOn -gt $since } |
  Sort-Object InstalledOn -Descending | Format-Table HotFixID, Description, InstalledOn -AutoSize

Write-Host "=== [4] SharePoint build version ===" -ForegroundColor Cyan
$spConfig = Get-Item "HKLM:\SOFTWARE\Microsoft\Shared Tools\Web Server Extensions\16.0\WSS"
Write-Host "SharePoint binaries present. Cross-reference build against the July 2025+ CU/security update baseline."

Write-Host "=== [5] Machine key rotation reminder ===" -ForegroundColor Yellow
Write-Host "If the server was EVER unpatched and internet-reachable after July 2025, the ASP.NET ValidationKey/DecryptionKey MUST be rotated via SharePoint Central Admin > Security > Machine Keys, then IISRESET. Patching alone does not evict an attacker holding stolen keys."

Write-Host "=== [6] Recent IIS logs: POSTs to suspicious endpoints ===" -ForegroundColor Cyan
$iisLogs = Get-ChildItem "C:\inetpub\logs\LogFiles" -Recurse -Filter "*.log" |
  Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-14) } | Sort-Object LastWriteTime -Descending
foreach ($log in $iisLogs | Select-Object -First 5) {
  Select-String -Path $log.FullName -Pattern 'POST.*(_layouts|_vti_bin|ToolPane)' |
    Select-Object -First 20 | ForEach-Object { $_.Line }
}