Elastic low stable kql

Potential Toolshell Initial Exploit (CVE-2025-53770 & CVE-2025-53771)

Identifies potential exploitation of CVE-2025-53770 and CVE-2025-53771 in IIS web servers on SharePoint sites. Toolshell is an exploit chain that leverages vulnerabilities in SharePoint/IIS to gain unauthorized access and execute commands. This rule detects HTTP requests that match specific patterns indicative of the exploit attempt.

View Source

Detection Logic

data_stream.dataset : "network_traffic.http" and
    url.path: (/_layouts*ToolPane.aspx* or /_layouts*toolpane.aspx*) and
    http.request.referrer: *SignOut.aspx and
    network.direction: "ingress" and
    http.request.method: "POST" and
    request: (*MSOTlPn_Uri* and *DisplayMode*) and
    http.request.body.bytes >  2000

Field Validations

Loading…

Comments (0)

Loading comments...