Skip to content

Commit d2791bf

Browse files
terrancedejesusMikaayensonw0rk3rSamirbous
authored
[New Rule] Toolshell Exploit Chain Detections (#4928)
* adding toolshell attack chain rules for exploit and RCE * updated query * added references * fixed references; linted * Update rules/network/execution_potential_rce_via_toolshell.toml Co-authored-by: Mika Ayenson, PhD <[email protected]> * Update rules/network/initial_access_potential_toolshell_exploit_attempt.toml Co-authored-by: Jonhnathan <[email protected]> * changed to BBR; lowered severity; adjusted queries * Update rules_building_block/execution_potential_rce_via_toolshell.toml Co-authored-by: Samirbous <[email protected]> * Update rules_building_block/execution_potential_rce_via_toolshell.toml Co-authored-by: Samirbous <[email protected]> * fixed from and interval failures * changed file name --------- Co-authored-by: Mika Ayenson, PhD <[email protected]> Co-authored-by: Jonhnathan <[email protected]> Co-authored-by: Samirbous <[email protected]>
1 parent 4aebb7d commit d2791bf

File tree

3 files changed

+154
-1
lines changed

3 files changed

+154
-1
lines changed

‎detection_rules/etc/non-ecs-schema.json‎

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,7 @@
4343
"TargetLogonId": "keyword",
4444
"TargetProcessGUID": "keyword",
4545
"TargetSid": "keyword",
46-
"SchemaFriendlyName": "keyword",
46+
"SchemaFriendlyName": "keyword",
4747
"Resource": "keyword",
4848
"RpcCallClientLocality": "keyword",
4949
"PrivilegeList": "keyword",
@@ -207,5 +207,17 @@
207207
"logs-okta*": {
208208
"okta.debug_context.debug_data.flattened.requestedScopes": "keyword",
209209
"okta.debug_context.debug_data.flattened.grantType": "keyword"
210+
},
211+
"logs-network_traffic.http*": {
212+
"data_stream.dataset": "keyword",
213+
"url.path": "keyword",
214+
"http.request.referrer": "keyword",
215+
"http.request.headers.content-type": "keyword",
216+
"network.direction": "keyword",
217+
"http.request.method": "keyword",
218+
"request": "keyword",
219+
"http.request.body.bytes": "long",
220+
"http.request.body.content": "keyword",
221+
"http.response.headers.server": "keyword"
210222
}
211223
}

‎rules_building_block/initial_access_potential_rce_via_toolshell.toml‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
[metadata]
2+
creation_date = "2025/07/23"
3+
integration = ["network_traffic"]
4+
maturity = "production"
5+
updated_date = "2025/07/23"
6+
7+
[rule]
8+
author = ["Elastic"]
9+
building_block_type = "default"
10+
description = """
11+
Detects potential remote code execution (RCE) attempts targeting IIS web servers running SharePoint via malicious
12+
VIEWSTATE payloads in HTTP POST requests. Attackers may exploit insecure deserialization in the VIEWSTATE parameter to
13+
execute arbitrary code. This rule identifies suspicious requests containing VIEWSTATE data and other indicators of
14+
exploitation, specifically those associated with the Toolshell exploit chain. Toolshell leverages vulnerabilities
15+
(CVE-2025-53770 and CVE-2025-53771) for initial access, enabling adversaries to deploy a webshell, steal machine keys,
16+
sign VIEWSTATE payloads offline, and subsequently send signed payloads to the server to achieve code execution.
17+
"""
18+
from = "now-119m"
19+
interval = "60m"
20+
index = ["logs-network_traffic.http*"]
21+
language = "kuery"
22+
license = "Elastic License v2"
23+
max_signals = 100
24+
name = "Potential VIEWSTATE RCE Attempt on SharePoint/IIS"
25+
references = [
26+
"https://research.eye.security/sharepoint-under-siege/",
27+
"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53771",
28+
"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53770",
29+
"https://msrc.microsoft.com/blog/2025/07/customer-guidance-for-sharepoint-vulnerability-cve-2025-53770/",
30+
]
31+
risk_score = 47
32+
rule_id = "99c9af5a-67cf-11f0-b69e-f661ea17fbcd"
33+
setup = """### Network Traffic Setup
34+
35+
This rule requires network traffic logs to be collected from HTTP endpoints, focusing on IIS web servers and SharePoint sites. Ensure logging captures HTTP request and response details, including headers and request bodies for POST requests. Monitoring VIEWSTATE content is critical for detecting deserialization attacks.
36+
"""
37+
severity = "medium"
38+
tags = [
39+
"Domain: Network",
40+
"Tactic: Initial Access",
41+
"Use Case: Exploit Detection",
42+
"Data Source: Network Traffic",
43+
"Data Source: Network Traffic HTTP Logs",
44+
"Rule Type: BBR"
45+
]
46+
timestamp_override = "event.ingested"
47+
type = "query"
48+
49+
query = '''
50+
data_stream.dataset : "network_traffic.http" and
51+
network.direction: "ingress" and
52+
http.request.method: "POST" and
53+
http.request.referrer: *SignOut.aspx and
54+
http.request.body.content: *__VIEWSTATE=* and
55+
http.request.body.bytes >= 500 and
56+
http.response.headers.server: Microsoft-IIS*
57+
'''
58+
59+
60+
[[rule.threat]]
61+
framework = "MITRE ATT&CK"
62+
[[rule.threat.technique]]
63+
id = "T1190"
64+
name = "Exploit Public-Facing Application"
65+
reference = "https://attack.mitre.org/techniques/T1190/"
66+
67+
68+
[rule.threat.tactic]
69+
id = "TA0001"
70+
name = "Initial Access"
71+
reference = "https://attack.mitre.org/tactics/TA0001/"
72+

‎rules_building_block/initial_access_potential_toolshell_exploit_attempt.toml‎

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
[metadata]
2+
creation_date = "2025/05/23"
3+
integration = ["network_traffic"]
4+
maturity = "production"
5+
updated_date = "2025/05/23"
6+
7+
[rule]
8+
author = ["Elastic"]
9+
building_block_type = "default"
10+
description = """
11+
Identifies potential exploitation of CVE-2025-53770 and CVE-2025-53771 in IIS web servers on SharePoint sites. Toolshell
12+
is an exploit chain that leverages vulnerabilities in SharePoint/IIS to gain unauthorized access and execute commands.
13+
This rule detects HTTP requests that match specific patterns indicative of the exploit attempt.
14+
"""
15+
from = "now-119m"
16+
interval = "60m"
17+
index = ["logs-network_traffic.http*"]
18+
language = "kuery"
19+
license = "Elastic License v2"
20+
max_signals = 100
21+
name = "Potential Toolshell Initial Exploit (CVE-2025-53770 & CVE-2025-53771)"
22+
references = [
23+
"https://research.eye.security/sharepoint-under-siege/",
24+
"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53771",
25+
"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53770",
26+
"https://msrc.microsoft.com/blog/2025/07/customer-guidance-for-sharepoint-vulnerability-cve-2025-53770/",
27+
]
28+
risk_score = 21
29+
rule_id = "6e4f6446-67ca-11f0-a148-f661ea17fbcd"
30+
setup = """### Network Traffic Setup
31+
32+
This rule requires network traffic logs to be collected from HTTP endpoints, specifically focusing on IIS web servers. Ensure that your network traffic logging is configured to capture HTTP request and response details, including request and response headers. Additionally, request bodies are necessary for content-type `application/x-www-form-urlencoded` to detect potential exploit attempts.
33+
"""
34+
severity = "low"
35+
tags = [
36+
"Domain: Network",
37+
"Tactic: Initial Access",
38+
"Use Case: Exploit Detection",
39+
"Data Source: Network Traffic",
40+
"Data Source: Network Traffic HTTP Logs",
41+
"Rule Type: BBR"
42+
]
43+
timestamp_override = "event.ingested"
44+
type = "query"
45+
46+
query = '''
47+
data_stream.dataset : "network_traffic.http" and
48+
url.path: (/_layouts*ToolPane.aspx* or /_layouts*toolpane.aspx*) and
49+
http.request.referrer: *SignOut.aspx and
50+
network.direction: "ingress" and
51+
http.request.method: "POST" and
52+
request: (*MSOTlPn_Uri* and *DisplayMode*) and
53+
http.request.body.bytes > 2000
54+
'''
55+
56+
57+
[[rule.threat]]
58+
framework = "MITRE ATT&CK"
59+
[[rule.threat.technique]]
60+
id = "T1190"
61+
name = "Exploit Public-Facing Application"
62+
reference = "https://attack.mitre.org/techniques/T1190/"
63+
64+
65+
[rule.threat.tactic]
66+
id = "TA0001"
67+
name = "Initial Access"
68+
reference = "https://attack.mitre.org/tactics/TA0001/"
69+

0 commit comments

Comments
 (0)