The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →To check for ToolShell exposure, first verify that every on-premises SharePoint Server has the applicable security updates; then separately investigate whether it may have been exploited before patching. Microsoft says SharePoint Online in Microsoft 365 is not affected. A patched server is not proof that an earlier compromise did not occur.
First confirm whether ToolShell applies to your SharePoint deployment
ToolShell refers to attacks involving CVE-2025-53770, an authentication-bypass and remote-code-execution vulnerability, and CVE-2025-53771, a path-traversal vulnerability. Microsoft says these affect on-premises SharePoint Server, not SharePoint Online in Microsoft 365. The related attack guidance also addresses CVE-2025-49704 and CVE-2025-49706. See Microsoft’s customer guidance and its security analysis.
As an Amazon Associate I earn from qualifying purchases.
- Determine where SharePoint runs. If your organization uses SharePoint Online only, these vulnerabilities do not apply to that service. If you operate SharePoint Server on premises, continue with the checks below.
- Identify the exact server release. Microsoft lists SharePoint Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition in its update guidance. If your deployment is on an unsupported release, follow Microsoft’s direction to move to a supported on-premises version.
Verify the updates installed on every server
Compare the updates actually installed on each relevant SharePoint server with Microsoft’s current product-specific guidance. Do not treat a farm as protected merely because one server was updated: check every server in the farm, and verify any applicable language-pack updates. The KB numbers Microsoft lists are:
| SharePoint Server release | Updates listed by Microsoft |
|---|---|
| Subscription Edition | KB5002768 |
| SharePoint Server 2019 | KB5002754 and language-pack KB5002753 |
| SharePoint Server 2016 | KB5002760 and language-pack KB5002759 |
Microsoft describes updates as cumulative, but specifically says to apply both provided updates for SharePoint 2016 and 2019. Confirm the current update record and the farm’s language-pack state rather than relying on the table alone. Microsoft’s July 2025 updates for the earlier CVEs do not, by themselves, establish that the later CVE-2025-53770 and CVE-2025-53771 fixes are installed.
#1 Best Overall
Where available, use Microsoft Defender Vulnerability Management to filter for CVE-2025-53770, CVE-2025-53771, CVE-2025-49704, and CVE-2025-49706. Review the affected devices, remediation status, and any evidence-of-exploitation tags. Defender External Attack Surface Management can help identify internet-facing SharePoint instances; internet exposure is a risk indicator, not proof that an attacker succeeded.
Investigate possible exploitation separately
Attackers may have accessed a server before it was patched. The Cyber Security Agency of Singapore warns that patching alone does not repair a compromise and says internet-exposed SharePoint servers during the exploitation window should be treated as at risk. Its SharePoint compromise guide sets out investigation and response steps.
Review requests and server logs
Collect and review IIS logs, SharePoint Unified Logging Service logs, and, where available, Windows Security, Application, System, PowerShell Script Block, and Sysmon logs. Investigate:
- POST requests to
/_layouts/15/ToolPane.aspx?DisplayMode=Editwith aRefererheader of/_layouts/SignOut.aspx. - Suspicious follow-up GET requests and requests from unusual source IP addresses.
These patterns are leads for investigation, not standalone proof of compromise. Correlate them with other log entries, files, and security-tool findings.
Search for web shells and related detections
Search SharePoint server file systems, especially the SharePoint TEMPLATELAYOUTS directories, for spinstall0.aspx, spinstall.aspx, spinstall1.aspx, spinstall2.aspx, and similarly named variants. Microsoft reports that observed payloads used spinstall0.aspx and variants to retrieve ASP.NET MachineKey data. Finding a web shell is a serious compromise indicator: preserve relevant evidence and follow your incident-response process.
Microsoft also documents Defender detections for possible web-shell installation, suspicious .NET assembly loading by the IIS worker process, and Trojan:PowerShell/MachineKeyFinder.DA!amsi. Use Microsoft’s linked indicators of compromise and hunting queries as current inputs; its security blog notes that threat intelligence and the blog are updated as the situation develops.
Reduce exposure and respond to suspected compromise
Microsoft’s defensive guidance combines patching with protections and recovery measures. Apply the latest updates to supported on-premises versions; ensure Antimalware Scan Interface (AMSI) integration is enabled and configured correctly; enable Full Mode when HTTP Request Body scanning is available; and deploy Microsoft Defender Antivirus or an equivalent solution and endpoint detection and response (EDR) on SharePoint servers.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteAfter updates or AMSI enablement, Microsoft says machine-key rotation and an IIS restart are critical. Rotate SharePoint Server ASP.NET machine keys with Set-SPMachineKey or the Central Administration Machine Key Rotation timer job, then restart IIS on all SharePoint servers.
Best Value
- Upgraded Two Zipper Pockets: Forvencer server books feature two secure zipper pockets for better organization of coins, cash, and receipts, ensuring that everything you collect has a safe and secure place
- Smart Storage & Quick Access: Designed with 8 multi-functional compartments, the right side includes a guest receipt pad, while the left has a money pocket, ticket pocket, and credit card slot. Two small clear pockets store bills, receipts, and other visible items. A stitched pen loop ensures you always have your favorite pen ready
- High-quality & Easy to Clean: Crafted from high-quality PU leather with heavy-duty stitching, this server book is built to last. It resists tears, scratches, and its waterproof surface makes cleaning easy with just a damp cloth or a non-chlorine sanitizer
- Perfect Fit for Your Apron: Measuring 5” x 8”, this compact organizer is slightly smaller than other models, making it ideal for bending or sitting while carrying in your server apron. It holds everything a waitress needs—a place for everything
- What's Included: This server organizer comes with multiple open and zippered pockets to store money, receipts, tips, etc. Clear sleeves are perfect for keeping menus or special lists while serving. Available in a variety of colors, allowing you to express yourself even when in uniform
If AMSI cannot be enabled, Microsoft advises considering disconnecting the server from the Internet until the latest update is applied. If disconnecting is not possible, restrict unauthenticated access using an authenticated VPN or proxy, or an authentication gateway.
If you suspect a compromise, do not treat patch installation as the entire response. Follow your organization’s incident-response plan and involve its security team. The Singapore CSA guide organizes response into identification, containment, remediation, and recovery; its recommendations include centralizing logs, investigating web shells and other artifacts, deploying and tuning EDR, removing persistence, and recovering the environment. Actions should be adapted to the affected farm and current Microsoft and government guidance.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →
