DFIR field guide: Investigating ToolShell-driven SharePoint intrusions (Talos IR Q3 2025)

Cisco Talos IR’s Q3 2025 report highlights a sharp rise in compromises that began with exploitation of on-premises Microsoft SharePoint via the ToolShell chain. More than 60% of Talos engagements involved exploitation of public-facing apps, and almost 40% showed ToolShell activity; ransomware dropped to ~20% of cases while post-exploitation phishing from compromised accounts continued to climb (Talos IR Q3 2025). Microsoft confirms active, multi-actor abuse of new SharePoint bugs (CVE-2025-53770, CVE-2025-53771) related to earlier July CVEs (CVE-2025-49704, CVE-2025-49706), and stresses that only on-prem servers are affected-not SharePoint Online (Microsoft Security TI, MSRC customer guidance). CISA added CVE-2025-53770 to the KEV catalog, underscoring exploitation in the wild (CISA KEV entry).

For DFIR, the ToolShell wave matters because adversaries often steal SharePoint MachineKey material (ValidationKey/DecryptionKey), enabling durable authentication forgery and viewstate abuse even after basic cleanup (Microsoft Security TI, Cloudflare analysis). Talos also observed Storm-2603 leveraging the open-source DFIR tool Velociraptor for persistence during ransomware operations, and notes a related Velociraptor privilege-escalation CVE-2025-6264 relevant to responders who find the tool in victim environments (Talos IR Q3 2025, NVD CVE-2025-6264).

ToolShell attack chain: what to expect on disk and in logs

Observed sequence on compromised on-prem SharePoint:

• Initial access: unauthenticated HTTP POST to the ToolPane endpoint (/_layouts/15/ToolPane.aspx or 16, depending on version) exploiting CVE-2025-53770/53771 related to earlier July fixes (Microsoft Security TI).
• Dropper/web shell: attackers upload an ASP.NET payload typically named spinstall0.aspx (variants: spinstall.aspx, spinstall1.aspx, etc.) under the SharePoint LAYOUTS directory to extract MachineKey material (Microsoft Security TI).
• Post-exploitation: w3wp.exe spawning cmd.exe and PowerShell (often with base64 encoded commands), lateral movement, credential access, and in some incidents Warlock/LockBit/Babuk deployment. Talos ties one case to Storm-2603 and notes Velociraptor abuse for persistence (Talos IR Q3 2025).

Key affected versions and scope:

• SharePoint Server 2016/2019/Subscription Edition; SharePoint Online is not affected (MSRC guidance).

Artefact locations and what to collect

Prioritize these sources on each SharePoint/WFE and related database servers:

• IIS HTTP logs (default): %SystemDrive%\inetpub\logs\LogFiles - look for POSTs to /_layouts/15/ToolPane.aspx or /_layouts/16/ToolPane.aspx, unusual user-agents, and spikes in 200/500 around first-seen times (Microsoft Learn - IIS logging, Microsoft Security TI).
• SharePoint ULS logs: %CommonProgramFiles%\Microsoft Shared\Web Server Extensions\16\LOGS (or 15\LOGS on older farms). Use Merge-SPLogFile for time-bound aggregation (Microsoft Learn - SP2019 upgrade logs/ULS path, Microsoft Learn - ULS path references).
• LAYOUTS web content directories where payloads were observed: C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\16\TEMPLATE\LAYOUTS\ (and 15\TEMPLATE\LAYOUTS\ on some builds). Hunt for spinstall*.aspx and other recent .aspx with anomalous size/timestamps (MSRC hunting query showing these paths).
• Windows Event Logs: Application, System, and the “Microsoft-SharePoint Products/Operational” channels for app pool resets, timer job activity, and unusual authentication messages (Microsoft Learn - SP logging references).
• Process execution and persistence: EDR telemetry for w3wp.exe spawning cmd.exe/powershell.exe -EncodedCommand, creation of Scheduled Tasks, unexpected IIS module/assembly loads, and signs of Velociraptor service/binaries if present (Microsoft Security TI, NVD CVE-2025-6264).

Quick hunts and detections

Microsoft 365 Defender (KQL) - from MSRC guidance

Look for spinstall0 creation under LAYOUTS folders (MSRC):

DeviceFileEvents
| where FolderPath has_any (@"microsoft shared\Web Server Extensions\16\TEMPLATE\LAYOUTS",
                              @"microsoft shared\Web Server Extensions\15\TEMPLATE\LAYOUTS")
| where FileName has "spinstall0"
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, FolderPath, SHA256
| order by Timestamp desc

Identify suspicious PowerShell spawned by w3wp with base64 payloads (MSRC):

DeviceProcessEvents
| where InitiatingProcessFileName =~ "w3wp.exe"
| where FileName =~ "cmd.exe"
| where ProcessCommandLine has_all ("cmd.exe", "powershell")
| where ProcessCommandLine has_any ("EncodedCommand", "-ec")

Microsoft Defender detection names to watch in telemetry: Exploit:Script/SuspSignoutReq.A, Exploit:Script/SuspSignoutReqBody.A, Trojan:Win32/HijackSharePointServer.A, Trojan:PowerShell/MachineKeyFinder.DA!amsi (MSRC).

Splunk (IIS W3C logs)

Detect ToolPane exploitation attempts:

index=iis sourcetype="ms:iis:auto" OR sourcetype="iis"
| search cs_method=POST cs_uri_stem="/_layouts/*/ToolPane.aspx"
| stats count by _time, cs_uri_stem, cs_Referer, c_ip, cs_User_Agent, sc_status, sc_bytes

Post-exploit file drop into LAYOUTS (if audited/file-create telemetry is ingested):

index=edr (file_path="*\\Web Server Extensions\\16\\TEMPLATE\\LAYOUTS\\spinstall*.aspx" OR file_path="*\\Web Server Extensions\\15\\TEMPLATE\\LAYOUTS\\spinstall*.aspx")
| stats values(host) as hosts, min(_time) as first_seen, max(_time) as last_seen by file_path, sha256

Sigma (web server) - exploit touchpoint

title: SharePoint ToolShell ToolPane Exploitation Attempt
logsource:
  category: webserver
  product: iis
  definition: Detects POSTs to ToolPane endpoint often used in ToolShell chain
detection:
  sel:
    cs-method: POST
    cs-uri-stem|contains: "/_layouts/"
    cs-uri-stem|endswith: "/ToolPane.aspx"
  condition: sel
level: high
references:
  - https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/

Local scoping PowerShell (triage)

List suspicious ASPX under LAYOUTS across hives (MSRC paths):

$paths = @(
  "C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\16\\TEMPLATE\\LAYOUTS",
  "C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\15\\TEMPLATE\\LAYOUTS"
)
Get-ChildItem -Path $paths -Filter "spinstall*.aspx" -Recurse -ErrorAction SilentlyContinue |
  Select-Object FullName, Length, CreationTimeUtc, LastWriteTimeUtc

Triage and response workflow (what to do in the first 24-72 hours)

1. Immediate containment

• Remove public exposure: place affected SharePoint servers behind an auth-gated proxy/VPN or disconnect from the Internet if AMSI cannot be enabled yet (MSRC).
• Segmentation: restrict WFE↔DB server communication to known ports; Talos stresses segmentation because actors abused the trusted SharePoint DB link to pivot and drop credential stealers internally (Talos IR Q3 2025).

2. Patch and harden (in this order)

• Apply the latest cumulative SharePoint updates that cover CVE-2025-53770/53771 and related July CVEs; supported versions only (Microsoft Security TI, MSRC).
• Enable AMSI integration for SharePoint and Defender AV (Full Mode) to block unauthenticated exploit traffic (MSRC).
• Rotate ASP.NET MachineKeys farm-wide and restart IIS on all SharePoint servers; this is critical because actors may already have stolen keys (MSRC, Cloudflare).

3. Compromise assessment and eradication

• Hunt for spinstall*.aspx and any recent .aspx implants under LAYOUTS; remove and retain copies for analysis (Microsoft Security TI).
• Review IIS/ULS timelines to establish first exploit time. IIS default logging path and ULS locations linked above (Microsoft Learn - IIS logging, Microsoft Learn - ULS path).
• Examine process trees from w3wp.exe for encoded PowerShell, credential access tooling, and lateral movement (PsExec/Impacket). Microsoft’s Storm-2603 case details these patterns (Microsoft Security TI).
• Validate that no unauthorized Scheduled Tasks, IIS modules, or startup persistence remain; Talos also observed Velociraptor used as persistence - scrutinize any Velociraptor servers/agents and remediate versions impacted by CVE-2025-6264 (Talos IR Q3 2025, NVD CVE-2025-6264).

4. Identity and email hardening (to blunt the observed follow-on phishing)

• Enforce strong MFA, detect MFA bombing/bypass, and monitor for impossible travel. Talos saw a third of cases involve MFA abuse and internal phishing from compromised mailboxes (Talos IR Q3 2025).

Ransomware and tradecraft notes for examiners

• Talos responded to Warlock, Babuk, Kraken, Qilin and LockBit variants in Q3; one Storm-2603 case chained ToolShell exploitation to ransomware and Velociraptor persistence (Talos IR Q3 2025).
• Microsoft attributes exploitation to multiple China-nexus actors (Linen Typhoon, Violet Typhoon, Storm-2603) and documents typical discovery, credential theft (LSASS/Mimikatz), lateral movement (PsExec, WMI), and GPO-based ransomware deployment (Microsoft Security TI).

Implication: if you find MachineKey theft, treat any later O365/Entra anomalies and on-prem SSO apps as potentially affected due to token forgery risk (Cloudflare).

Prevent, detect, and monitor going forward

• Patch velocity and coverage: ensure all SharePoint farms run supported versions with current updates for CVE-2025-53770/53771 and July CVEs; validate AMSI Full Mode is enabled on SharePoint (2016/2019 enablement shipped in Sept 2023, 23H2 for Subscription Edition) (MSRC).
• External exposure: keep SharePoint off the raw Internet where possible; front with auth-gated reverse proxy/VPN and a WAF that knows the ToolShell patterns (MSRC).
• Logging hygiene: centralize IIS/ULS logs (default IIS path %SystemDrive%\inetpub\logs\LogFiles; ULS %CommonProgramFiles%\Microsoft Shared\Web Server Extensions\16\LOGS) with adequate retention and forward to SIEM (Microsoft Learn - IIS logging, Microsoft Learn - ULS path).
• Detections: keep the ToolPane POST detection in place, file-creation alerts for LAYOUTS spinstall*.aspx, and EDR analytics for w3wp.exe → cmd.exe/powershell with encoded payloads (Microsoft Security TI, MSRC).

Takeaways

• Prioritize SharePoint: assume compromise if on-prem WFEs were Internet-exposed in July-August; patch, enable AMSI, rotate MachineKeys, and restart IIS (MSRC).
• Hunt immediately: query for ToolPane POSTs, spinstall*.aspx under LAYOUTS, and w3wp.exe spawning encoded PowerShell (Microsoft Security TI).
• Contain laterally: segment SharePoint/SQL and treat the farm as a potential credential-stealing bridgehead, as observed by Talos (Talos IR Q3 2025).
• Watch for persistence: investigate any Velociraptor deployments and remediate vulnerable versions (CVE-2025-6264) if found (NVD CVE-2025-6264).
• Prepare for phishing fallout: strengthen MFA and detections for internal phishing and mailbox rule abuse (Talos IR Q3 2025).