[[ fm.text ]] Click here

SharePoint IIS Worker Webshell Write - STRICT

SIGMA detection rule by Adama ASSIONGBON (SOC & CTI Consultant), https://linkedin.com/in/adama-assiongbon-9029893a · Unknown

Detects the SharePoint IIS worker writing an active server-side script into a web-accessible SharePoint directory, a high-confidence post-exploitation effect consistent with CVE-2026-58644. SOC L1 should verify the source, affected host, user, process or request fields, timing, and related activity. Détecte le worker IIS de SharePoint écrivant un script serveur actif dans un répertoire SharePoint exposé par IIS, effet post-exploitation haute confiance compatible avec CVE-2026-58644. Le SOC L1 doit vérifier la source, l’hôte affecté, l’utilisateur, les champs de processus ou de requête, la chronologie et les activités associées.

title: SharePoint IIS Worker Webshell Write - STRICT
id: 6bd3b4b8-7590-4579-a0e4-1adf62ba5c0a
status: experimental
description: |
  Detects the SharePoint IIS worker writing an active server-side script into a web-accessible SharePoint directory, a high-confidence post-exploitation effect consistent with CVE-2026-58644. SOC L1 should verify the source, affected host, user, process or request fields, timing, and related activity.
  Détecte le worker IIS de SharePoint écrivant un script serveur actif dans un répertoire SharePoint exposé par IIS, effet post-exploitation haute confiance compatible avec CVE-2026-58644. Le SOC L1 doit vérifier la source, l’hôte affecté, l’utilisateur, les champs de processus ou de requête, la chronologie et les activités associées.
references:
  - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58644
  - https://nvd.nist.gov/vuln/detail/CVE-2026-58644
author: Adama ASSIONGBON (SOC & CTI Consultant), https://linkedin.com/in/adama-assiongbon-9029893a
date: 2026-07-16
logsource:
  product: windows
  category: file_event
detection:
  selection_worker:
    Image|endswith: '\w3wp.exe'
  selection_script:
    TargetFilename|endswith:
      - '.aspx'
      - '.ashx'
      - '.asmx'
      - '.asax'
      - '.svc'
  selection_sharepoint_webroot:
    TargetFilename|contains:
      - '\TEMPLATE\LAYOUTS\'
      - '\14\TEMPLATE\LAYOUTS\'
      - '\15\TEMPLATE\LAYOUTS\'
      - '\ISAPI\'
      - '\wwwroot\'
      - '\WebServerExtensions\'
  filter_main_known_deployment:
    ParentImage|endswith:
      - '\OWSTIMER.EXE'
      - '\PSConfig.exe'
      - '\stsadm.exe'
  condition: all of selection_* and not filter_main_known_deployment
fields:
  - UtcTime
  - EventID
  - Computer
  - User
  - Image
  - ParentImage
  - TargetFilename
  - CreationUtcTime
  - ProcessGuid
  - ProcessId
falsepositives:
  - Authorized SharePoint solution deployment or feature activation during a documented maintenance window
  - Web application publishing workflows that intentionally create server-side script files
level: high
tags:
  - attack.persistence
  - attack.execution
  - attack.t1505.003
  - cve.2026-58644

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

3706307f-b1ea-464f-a562-9bd59a907876

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion