SharePoint is a high-value enterprise application, and successful exploitation can provide attackers with access to sensitive data and execution within IIS. The source defines several complementary hunts for SharePoint ToolShell and later RCE chains.

The coverage includes CVE-2025-53770, CVE-2025-49704, CVE-2025-49706, and later SharePoint RCE, authentication-bypass, and deserialization vulnerabilities.

HTTP and Filename Indicators

The first hunt searches logs for ToolPane and known spinstall filenames:

full_log:("/_layouts/15/ToolPane.aspx" or "spinstall0.aspx" or "spinstall1.aspx" or "spinstall2.aspx" or "spinstall.aspx")

The source recorded 303 results during the previous 30 days.

These strings alone do not prove exploitation, but they provide useful campaign- and product-specific indicators for triage.

File Integrity and Sysmon Monitoring

The second hunt checks for suspicious spinstall*.aspx files created under SharePoint layouts or the IIS web root:

(rule.groups:syscheck and syscheck.event:(added or modified) and syscheck.path:(*\_layouts\*spinstall*.aspx or *\inetpub\wwwroot\*spinstall*.aspx)) or (data.win.system.eventID:11 and data.win.eventdata.targetFilename:(*\_layouts\*spinstall*.aspx or *\inetpub\wwwroot\*spinstall*.aspx))

The source recorded zero matches for this query.

MachineKey and Post-RCE Execution

A third detection monitors IIS worker processes for shell execution and commands related to MachineKey material or system discovery:

data.win.system.eventID: 1 and data.win.eventdata.parentImage: *\w3wp.exe and (data.win.eventdata.commandLine: (*machineKey* or *ValidationKey* or *DecryptionKey* or *whoami* or *ipconfig* or *nltest* or *net*user* or *net*group*) or data.win.eventdata.image: (*\cmd.exe or *\powershell.exe or *\pwsh.exe))

The source also recorded zero matches for this process hunt.

Interpreting the 303 HTTP Matches

The HTTP indicator query produced significantly more results than the file or process hunts. That means analysts should not assume every match represents a successful attack.

Useful enrichment includes:

• SharePoint server hostname;

• source IP;

• HTTP method;

• response status;

• requested path;

• authenticated user;

• follow-on file changes;

• w3wp.exe child processes.

If an HTTP indicator is followed by a suspicious ASPX file and then shell execution, confidence increases substantially.

Investigation Priorities

A SharePoint investigation should correlate web logs with endpoint telemetry.

Look for:

• suspicious spinstall files;

• unexpected changes under _layouts;

• IIS worker processes launching shells;

• commands involving MachineKey values;

• discovery commands such as whoami, ipconfig, or nltest;

• outbound network activity.

Tuning

Known administrative requests or benign references to ToolPane may account for some events. Exceptions should be based on verified legitimate activity rather than broad path exclusions.

Operational Value

The three hunts provide different perspectives on the same product: HTTP indicators, file changes, and post-RCE process activity.

Used together, they allow defenders to move from a broad SharePoint indicator to higher-confidence evidence of execution and persistence.