SOC Incident Analysis Exposes Active Exploitation of CVE-2025-53770 SharePoint ToolShell Auth Bypass and RCE

SOC analysts have published a detailed incident report on Letsdefend SOC342, covering the exploitation of CVE-2025-53770 — a critical SharePoint ToolShell authentication bypass and remote code execution vulnerability.

The alert was generated by the rule “CVE-2025-53770 SharePoint ToolShell Auth Bypass and RCE” after detecting a suspicious unauthenticated POST request to ToolPane.aspx with an abnormally large Content-Length and a spoofed referer pointing to /layouts/SignOut.aspx. The request was allowed by the security control, indicating the payload reached the server.

Initial Triage and Vulnerability Confirmation

Analysts confirmed the server was likely vulnerable because the observed behavior matched public exploitation indicators published by CISA. The source IP 107.191.58.76 was already listed in the CISA advisory and scored malicious on VirusTotal (10/92 vendors).

Network logs showed the POST request successfully reached the SharePoint server. Subsequent process telemetry revealed w3wp.exe (the IIS worker process) spawning PowerShell with the flags -nop -w hidden -e, followed by Base64-decoded commands that dumped ASP.NET machine keys.

Post-Exploitation Activity

The extracted keys would allow an attacker to forge and sign ViewState payloads, achieving unauthenticated remote code execution. The same w3wp.exe process later launched csc.exe to compile C# source code dropped in C:\Windows\Temp\payload.cs.

Attackers also created a malicious file at C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\16\TEMPLATE\LAYOUTS\spinstall0.aspx that used an ActiveX object (CLSID ADB880A6-D8FF-11CF-9377-00AA003B7A11) to execute or download additional payloads when a user visited the page.

• Network IOC: 107.191.58.76 (C2 and payload hosting)
• File hashes (SHA-256): 10e01ce96889c7b4366cfa1e7d99759e4e2b6e5dfe378087d9e836b7278abfb6 (machinekey.aspx), 92bb4ddb98eeaf11fc15bb32e71d0a63256a0ed826a03ba293ce3a8bf057a514 (spinstall0.aspx)
• Process chain: w3wp.exe → powershell.exe → csc.exe → cmd.exe → powershell.exe

Containment Actions

After confirming compromise, the server was isolated. Recommended remediation steps include blocking the malicious IP, deleting the dropped files, adding the observed hashes to blocklists, patching SharePoint to a safe version, and rotating all ASP.NET cryptographic keys.