Attempted SharePoint Webshell Creation CVE-2025-53770

/*
 * Copyright 2025 Google LLC
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *     https://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */


rule ttp_windows_sharepoint_cve_2025_53770_webshell_attempted {
  meta:
    author = "Google Cloud Security"
    rule_name = "Attempted SharePoint Webshell Creation CVE-2025-53770"
    description = "Detects the attempted creation of a file containing 'spinstall0' in specific SharePoint LAYOUTS directories. This activity is a strong indicator of an attempt to exploit the SharePoint Server vulnerability CVE-2025-53770."
    severity = "High"
    tactic = "TA0003"
    technique = "T1505.003"
    false_positives = "Extremely Low, as the filename and location are highly specific to this exploit."
    reference = "https://msrc.microsoft.com/blog/2025/07/customer-guidance-for-sharepoint-vulnerability-cve-2025-53770/"
    rule_id = "mr_c174ff49-5dd5-42c5-b41b-8b11b42c0a64"

  events:
      // Event must be a file creation on a Windows system
      (
        $e.metadata.event_type = "FILE_CREATION" or
        $e.metadata.event_type = "STATUS_UPDATE"
      )
      // The file path must be within the SharePoint 15 or 16 hive's LAYOUTS directory.
      $e.target.file.full_path = /[\x2F\x5C]+(?:Program\ Files|Progra~[1-9])[\x2F\x5C]+(?:Common\ Files|Common~[1-9])[\x2F\x5C]+(?:Microsoft\ Shared|Micros~[1-9])[\x2F\x5C]+(?:Web\ Server\ Extensions|WebSer~[1-9])[\x2F\x5C]+16[\x2F\x5C]+TEMPLATE[\x2F\x5C]+LAYOUTS[\x2F\x5C]+spinstall0\.aspx/ nocase
      // Capture hostname for match
      $hostname = strings.coalesce($e.principal.asset_id, $e.principal.asset.asset_id, $e.principal.hostname)

  match:
    $hostname over 5m

  outcome:
    $risk_score = max(85)
    $vendor_name = array_distinct($e.metadata.vendor_name)
    $product_name = array_distinct($e.metadata.product_name)
    $event_count = count_distinct($e.metadata.id)
    $victim_name = array_distinct($hostname)
    $victim_asset_id = array_distinct($e.principal.asset.asset_id)
    $victim_ip = array_distinct($e.principal.asset.ip)
    $result = "attempted"
    $result_time = min($e.metadata.event_timestamp.seconds)
    $file_paths = array_distinct($e.target.file.full_path)

 condition:
   $e
}