LoFP / limited false positives are expected as legitimate use of the toolpane.aspx endpoint with displaymode=edit parameter in post requests is uncommon. however, some sharepoint administration activities might trigger this detection. verify against known administrator ips and activity patterns.

Techniques

• T1190
• T1505.003

Sample rules

Windows SharePoint ToolPane Endpoint Exploitation Attempt

• source: splunk
• technicques:
  • T1190
  • T1505.003

Description

The following analytic detects potential exploitation attempts against Microsoft SharePoint Server vulnerability CVE-2025-53770, also known as “ToolShell”. This detection monitors for POST requests to the ToolPane.aspx endpoint with specific DisplayMode parameter, which is a key indicator of the exploit. This vulnerability allows unauthenticated remote code execution on affected SharePoint servers, enabling attackers to fully access SharePoint content, file systems, internal configurations, and execute code over the network.

Detection logic

| tstats count min(_time) as firstTime max(_time) as lastTime from datamodel=Web where Web.url="*/_layouts/15/ToolPane.aspx*" AND Web.url="*DisplayMode=Edit*" Web.http_method=POST by Web.http_user_agent, Web.status, Web.http_method, Web.url, Web.url_length, Web.src, Web.dest, sourcetype 
| `drop_dm_object_name("Web")` 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)` 
| `windows_sharepoint_toolpane_endpoint_exploitation_attempt_filter`