Protect SharePoint Servers from ToolShell Exploit Now

Image credit: Photo by Rebecca Wang / CC BY 4.0

CISA released a detailed malware analysis on SharePoint vulnerabilities being actively exploited. The “ToolShell” exploit chains CVE-2025-49704 with CVE-2025-49706 to compromise SharePoint servers, deploying web shells and .NET DLLs that steal cryptographic keys.

The malware deploys Base64-encoded DLLs that extract ASP.NET machineKey values and inject them into HTTP response headers—compromising the server’s cryptography and enabling PowerShell command execution for data theft. CISA analyzed these DLLs, including a key stealer and three ASPX web shells, providing IOCs and SIGMA detection rules for security monitoring.

Viettel disclosed these vulnerabilities at Pwn2Own Berlin, and Microsoft patched them in July’s Patch Tuesday. But attackers exploited unpatched systems first. CISA marked three CVEs as Known Exploited between July 20-22, confirming active exploitation in the wild.

Run the IOCs against your SharePoint servers immediately and deploy the SIGMA rules. The detection content includes STIX2 JSON for IOCs and three YAML files for SIGMA rules. Even with Microsoft’s patches available, assume some systems remain vulnerable or already compromised—attackers had weeks to exploit this before patches were released.