Warlock (China-Linked) Exploiting SharePoint Flaws to Disable Security Tools and Deploy Ransomware: Detection and Hardening Guide

---
title: SharePoint Worker Process Spawning Command Shell or Scripting Engine
id: 3f8a1b72-6c4d-4e9a-bf21-7d5c9a2e8f34
status: experimental
description: Detects the SharePoint IIS worker process (w3wp.exe) spawning cmd, PowerShell, or other scripting engines — a hallmark of SharePoint exploit post-exploitation and webshell activity as observed in Warlock intrusions.
references:
  - https://thehackernews.com/2026/10/warlock-exploits-sharepoint-flaws-to.html
  - https://attack.mitre.org/techniques/T1190/
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/10/22
tags:
  - attack.initial_access
  - attack.t1190
  - attack.persistence
  - attack.t1505.003
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\w3wp.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\cscript.exe'
      - '\wscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare custom SharePoint solutions that invoke scripts from workflows — validate against your environment; this should be near-zero in most orgs
level: high
---
title: Webshell File Created in SharePoint LAYOUTS Directory
id: 9c2e5d41-8b3f-4a67-9c15-2e7f4b8d6a91
status: experimental
description: Detects creation of ASPX/ASP script files in SharePoint TEMPLATE\LAYOUTS or related web directories by non-SharePoint processes — consistent with webshell deployment following SharePoint exploitation.
references:
  - https://thehackernews.com/2026/10/warlock-exploits-sharepoint-flaws-to.html
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/10/22
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: file_event
  product: windows
detection:
  selection_path:
    TargetFilename|contains:
      - '\Web Server Extensions\16\TEMPLATE\LAYOUTS\'
      - '\Web Server Extensions\15\TEMPLATE\LAYOUTS\'
      - '\inetpub\wwwroot\wss\'
  selection_ext:
    TargetFilename|endswith:
      - '.aspx'
      - '.asp'
      - '.ashx'
      - '.asmx'
      - '.php'
  filter_installers:
    Image|endswith:
      - '\msiexec.exe'
      - '\setup.exe'
      - '\wsstracing.exe'
  condition: selection_path and selection_ext and not filter_installers
falsepositives:
  - SharePoint cumulative update installations and legitimate custom solution deployments — correlate with patch windows
level: high
---
title: Security Tool Tampering Preceding Ransomware Deployment
id: 5b7d3e18-2f6a-4c94-8d31-4a9c7e2b5f68
status: experimental
description: Detects attempts to disable Defender real-time protection, stop security services, delete shadow copies, or clear event logs — behavior Warlock performs before deploying encryption payloads.
references:
  - https://thehackernews.com/2026/10/warlock-exploits-sharepoint-flaws-to.html
  - https://attack.mitre.org/techniques/T1562/001/
  - https://attack.mitre.org/techniques/T1490/
author: Security Arsenal
date: 2026/10/22
tags:
  - attack.defense_evasion
  - attack.t1562.001
  - attack.impact
  - attack.t1490
logsource:
  category: process_creation
  product: windows
detection:
  selection_defender:
    CommandLine|contains:
      - 'Set-MpPreference'
      - 'DisableRealtimeMonitoring'
      - 'DisableAntiSpyware'
      - 'Add-MpPreference -ExclusionPath'
  selection_shadow:
    CommandLine|contains:
      - 'vssadmin delete shadows'
      - 'vssadmin.exe delete'
      - 'shadowcopy delete'
      - 'wmic shadowcopy'
      - 'bcdedit'
  selection_services:
    CommandLine|contains:
      - 'sc stop'
      - 'sc config'
      - 'sc delete'
      - 'net stop'
      - 'taskkill /f /im'
  selection_logs:
    CommandLine|contains:
      - 'wevtutil cl'
      - 'Clear-EventLog'
  condition: 1 of selection_*
falsepositives:
  - Legitimate administrative scripts (backup software may delete shadow copies; admins occasionally stop services) — baseline and tune; investigate any occurrence on a SharePoint server as high priority
level: high

// Hunt: SharePoint exploitation + post-exploit tampering chain (Warlock TTPs)
let SharePointServers = (DeviceNetworkEvents
| where LocalPort in (80, 443) and InitiatingProcessFileName =~ "w3wp.exe"
| summarize by DeviceName);
let SuspiciousChildren = DeviceProcessEvents
| where InitiatingProcessFileName =~ "w3wp.exe"
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "cscript.exe", "wscript.exe",
                      "mshta.exe", "rundll32.exe", "certutil.exe", "bitsadmin.exe", "whoami.exe",
                      "net.exe", "nltest.exe", "quser.exe")
| project DeviceName, TimeGenerated, ShellCmd=ProcessCommandLine, ShellProcess=FileName, AccountName;
let Tampering = DeviceProcessEvents
| where ProcessCommandLine has_any (
    "DisableRealtimeMonitoring", "Set-MpPreference", "Add-MpPreference",
    "vssadmin delete", "shadowcopy delete", "bcdedit",
    "wevtutil cl", "Clear-EventLog", "sc stop", "sc delete")
| project DeviceName, TamperTime=TimeGenerated, TamperCmd=ProcessCommandLine, TamperProcess=FileName;
SuspiciousChildren
| join kind=inner Tampering on DeviceName
| where TamperTime between (TimeGenerated .. TimeGenerated + 72h)
| project DeviceName, ExploitTime=TimeGenerated, ShellCmd, TamperTime, TamperCmd, AccountName
| sort by DeviceName, ExploitTime;

// Hunt: script files written into SharePoint web directories by non-installer processes
DeviceFileEvents
| where FolderPath has_any ("Web Server Extensions\\15\\TEMPLATE\\LAYOUTS",
                            "Web Server Extensions\\16\\TEMPLATE\\LAYOUTS")
| where FileName endswith_any (".aspx", ".asp", ".ashx", ".asmx", ".php")
| where InitiatingProcessFileName !in~ ("msiexec.exe", "setup.exe", "psconfig.exe", "wsstracing.exe")
| project TimeGenerated, DeviceName, FileName, FolderPath, InitiatingProcessFileName,
          InitiatingProcessCommandLine, SHA256
| sort by TimeGenerated desc;

-- Hunt for webshell artifacts in SharePoint LAYOUTS directories
-- Deploy against all on-prem SharePoint servers; flag files modified outside approved patch windows
LET layouts_roots = glob([
  'C:/Program Files/Common Files/microsoft shared/Web Server Extensions/15/TEMPLATE/LAYOUTS',
  'C:/Program Files/Common Files/microsoft shared/Web Server Extensions/16/TEMPLATE/LAYOUTS'
])

SELECT FullPath,
       Mtime AS Modified,
       Ctime AS Created,
       Size,
       hash(path=FullPath).MD5 AS MD5
FROM glob(globs=layouts_roots + '/**/*.{aspx,asp,ashx,asmx,php}',
          accessor='ntfs')
WHERE Modified > now() - 604800
ORDER BY Modified DESC

-- Live hunt: suspicious child processes of w3wp.exe
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ 'cmd.exe|powershell|pwsh|cscript|mshta|certutil|bitsadmin|vssadmin|wevtutil'
  AND Ppid IN (SELECT Pid FROM pslist() WHERE Name =~ 'w3wp')

# ============================================================
# Warlock / SharePoint Exploitation — Verification & Hardening
# Run elevated on each SharePoint server. Review output; do not
# blindly remediate on production — snapshot first.
# ============================================================

# --- 1. Report SharePoint build (compare against latest CU) ---
$spBuild = (Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Shared Tools\Web Server Extensions\16.0" -ErrorAction SilentlyContinue).Version
Write-Host "[+] SharePoint build: $spBuild  -- verify against https://learn.microsoft.com/en-us/officeupdates/sharepoint-updates" -ForegroundColor Cyan

# --- 2. Audit LAYOUTS for script files modified in last 14 days ---
$layouts = @(
  "C:\Program Files\Common Files\microsoft shared\Web Server Extensions\15\TEMPLATE\LAYOUTS",
  "C:\Program Files\Common Files\microsoft shared\Web Server Extensions\16\TEMPLATE\LAYOUTS"
)
foreach ($root in $layouts) {
  if (Test-Path $root) {
    Get-ChildItem $root -Recurse -Include *.aspx,*.asp,*.ashx,*.asmx,*.php -ErrorAction SilentlyContinue |
      Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-14) } |
      Select-Object FullName, LastWriteTime, Length |
      Format-Table -AutoSize
  }
}

# --- 3. Check Defender tamper protection & real-time status ---
Get-MpComputerStatus | Select-Object AMServiceEnabled, RealTimeProtectionEnabled,
  IsTamperProtected, AntivirusSignatureLastUpdated | Format-List

# --- 4. Look for Defender tampering registry artifacts ---
$defenderPolicy = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender"
if (Test-Path $defenderPolicy) {
  Get-ItemProperty $defenderPolicy | Select-Object DisableAntiSpyware, DisableRealtimeMonitoring
}

# --- 5. List suspicious children of w3wp.exe (live state) ---
$w3wp = Get-CimInstance Win32_Process -Filter "Name='w3wp.exe'"
foreach ($p in $w3wp) {
  Get-CimInstance Win32_Process -Filter "ParentProcessId=$($p.ProcessId)" |
    Where-Object { $_.Name -match 'cmd|powershell|pwsh|cscript|wscript|mshta|certutil|vssadmin|wevtutil' } |
    Select-Object ProcessId, Name, CommandLine, CreationDate | Format-List
}

# --- 6. Enable IIS + SharePoint verbose logging if not present ---
# Ensure IIS logs (including POST bodies via failed-request tracing where feasible)
# and SharePoint ULS logs are retained >= 180 days and shipped to your SIEM.
Write-Host "[+] Confirm IIS logs at C:\inetpub\logs\LogFiles are forwarded to SIEM." -ForegroundColor Cyan