Elastic Security Detection Rules

Potential Toolshell Initial Exploit (CVE-2025-53770 & CVE-2025-53771)

Last updated 8 days ago on 2026-10-06
Created a year ago on 2025-05-23

About

Identifies potential exploitation of CVE-2025-53770 and CVE-2025-53771 in IIS web servers on SharePoint sites. Toolshell is an exploit chain that leverages vulnerabilities in SharePoint/IIS to gain unauthorized access and execute commands. This rule detects HTTP requests that match specific patterns indicative of the exploit attempt.
Tags
Domain: NetworkTactic: Initial AccessUse Case: Exploit DetectionData Source: Network TrafficData Source: Network Traffic HTTP LogsRule Type: BBRRule Type: Custom Query (KQL)Data Source: Network Packet CaptureVuln: CVE-2025-53770Vuln: CVE-2025-53771Language: kuery
Severity
low
Risk Score
21
MITRE ATT&CK™

Initial Access (TA0001)(external, opens in a new tab or window)

↳ Exploit Public-Facing Application (T1190)(external, opens in a new tab or window)

License
Elastic License v2(external, opens in a new tab or window)

Definition

Rule Type
Query (Kibana Query Language)
Integration Pack
Prebuilt Security Detection Rules
Index Patterns
logs-network_traffic.http*
Related Integrations

network_traffic(external, opens in a new tab or window)

Query
text code block:
data_stream.dataset : "network_traffic.http" and
    url.path: (/_layouts*ToolPane.aspx* or /_layouts*toolpane.aspx*) and
    http.request.referrer: *SignOut.aspx and
    network.direction: "ingress" and
    http.request.method: "POST" and
    request: (*MSOTlPn_Uri* and *DisplayMode*) and
    http.request.body.bytes >  2000

Install detection rules in Elastic Security

Detect Potential Toolshell Initial Exploit (CVE-2025-53770 & CVE-2025-53771) in the Elastic Security detection engine by installing this rule into your Elastic Stack.

To setup this rule, check out the installation guide for Prebuilt Security Detection Rules(external, opens in a new tab or window).