Skip to content
Industry — Finance — Cybersecurity — Investing — Business — Personal-finance — Technology — All about education & self-development. — Politics — General-news — Crime-and-justice — sports — Football — nfl — American-football — ncaa-football — sports-analysis

Unraveling the SharePoint Breach: Permanent Mission, Discovery, and Takeaways

Uncovered SharePoint vulnerability demonstrates sophisticated perpetration techniques and poses difficulties in identification. Delve into tactics used by hackers for long-term infiltration, strategies for recognizing unauthorized access, and insights organizations can gather from this security...

,   and  Administrator
2 min read
Unpacking SharePoint Vulnerability - Maintaining Access, Identifying Threats, and Key Learnings
Unpacking SharePoint Vulnerability - Maintaining Access, Identifying Threats, and Key Learnings

Unraveling the SharePoint Breach: Permanent Mission, Discovery, and Takeaways

Securing SharePoint Environments Against Persistent Threats

In the wake of the rapid evolution of the ToolShell campaign, organisations relying on legacy on-premises SharePoint deployments are urged to bolster their security measures. Here are some recommended steps to strengthen the defence of SharePoint environments.

Implementing Multi-layered Defence

To secure SharePoint environments beyond applying patches and prevent attacker persistence after CVE-2025-53770 and CVE-2025-53771 exploitation, organisations should adopt a comprehensive multi-layered defence approach. This includes:

  1. Enforcing Role-Based Access Control (RBAC) and Principle of Least Privilege (PoLP): Assign permissions strictly based on job roles and audit these regularly to remove excessive or stale privileges.
  2. Enabling Multi-Factor Authentication (MFA): Require MFA for all users accessing SharePoint to reduce risk from compromised credentials.
  3. Rotating ASP.NET Machine Keys: After applying security updates, rotate SharePoint Server ASP.NET machine keys to invalidate attackers' cryptographic material used for persistence.
  4. Harding the Network: Isolate SharePoint farm servers in dedicated network segments, restrict communication to essential ports only, and tightly control SQL Server backend access with firewall rules permitting only SharePoint server IPs.
  5. Regular Permission Reviews and Audits: Continuously review and clean up permissions to prevent privilege creep and minimize attack surface.
  6. Incident Response and Backdoor Hunting: Beyond patching, assume attackers might have deployed backdoors or stolen tokens. Conduct thorough scans, logs analysis, and forensics to detect and evict any persistent threats.
  7. Consider Migration to Microsoft 365 (SharePoint Online): Since on-premises versions are vulnerable and require full customer responsibility for patching and security, migrating to Microsoft's cloud-hosted SharePoint Online, which receives continuous and timely updates, can substantially reduce exposure to these exploits.

Monitoring and Detecting Threats

In addition to the above measures, organisations should monitor their SharePoint environments for suspicious activities. This includes:

  • Implementing File Integrity Monitoring (FIM) on the SharePoint LAYOUTS directory to detect unauthorized ASPX file creation.
  • Monitoring Internet Information Services (IIS) logs for suspicious activity targeting the vulnerable endpoint: requests with a header set to .
  • Monitoring for connections to known malicious IPs associated with the ToolShell campaign: , , , .
  • Enabling advanced PowerShell logging to detect malicious executions, particularly those spawned by the IIS worker process ().
  • Leveraging advanced hunting queries to detect compromise indicators, such as web shell detection and suspicious process activity.
  • Monitoring for ViewState anomalies, such as unusually large fields or unexpected POST requests to .
  • Enabling AMSI and deploying Endpoint Protection for enhanced monitoring and post-exploit activity detection.

Preventing Lateral Movement

Attackers often use stolen SharePoint credentials or service accounts to pivot to adjacent systems like Microsoft Exchange, SQL Server, or Active Directory. To prevent this, organisations should segregate SharePoint servers to prevent lateral movement to critical systems.

Conclusion

By combining stringent access controls, strong authentication, network hardening, cryptographic key rotation, regular permission audits, active threat hunting, and considering moving to Microsoft 365, organisations can effectively secure their SharePoint environments against persistent threats.

Read also:

Related

Latest