Start with unusual HTTP POST requests to /_layouts/15/ToolPane.aspx, then correlate IIS logs with SharePoint layout-file changes, IIS worker-process activity, Defender alerts, and network events. A suspicious request or a missing web-shell file alone cannot confirm or rule out compromise.
This hunt applies to on-premises SharePoint Server. Microsoft says the vulnerabilities covered by its guidance did not affect SharePoint Online in Microsoft 365. Confirm which SharePoint servers and versions are in scope before investigating; patch applicability and product support can change. Microsoft’s customer guidance identifies the affected environment and response steps.
As an Amazon Associate I earn from qualifying purchases.
What ToolShell means for a log hunt
ToolShell refers to exploitation activity involving vulnerabilities in on-premises SharePoint Server. CERT-EU’s chronology says Microsoft disclosed and released updates for CVE-2025-49704 and CVE-2025-49706 on July 8, 2025; active exploitation of a variation was detected on July 18. Further investigation identified CVE-2025-53770 and CVE-2025-53771, which bypassed the earlier updates. Microsoft described CVE-2025-53770 as an authentication bypass and remote code execution vulnerability, and CVE-2025-53771 as a path traversal vulnerability. CERT-EU’s chronology and Microsoft’s July 2025 threat-intelligence article provide campaign context and hunting queries.
Free tools Windows power users keep installed
One-click scans. No signup required.
Microsoft’s customer guidance listed SharePoint Server Subscription Edition, 2019, and 2016 among the versions for which it published updates at the time. Check current support and update applicability for the specific farm rather than assuming that an old version list describes today’s status.
#1 Best Overall
Prepare the hunt and preserve evidence
Define the farm boundary first: identify every on-premises SharePoint server, its patch level, and its IIS sites. Choose a time window that begins before the earliest suspicious request or alert and extends far enough to investigate possible use of exposed keys, credentials, or network access.
Preserve the original records before rotating keys, restarting IIS, or making other changes. Collect the following sources where available:
- IIS W3C access logs and upstream firewall, proxy, or HTTP gateway records
- Endpoint process and file-event telemetry, including full command lines and process ancestry
- Microsoft Defender alerts and related investigation data
- DNS, network-session, SMB, and other relevant internal network events
The Canadian Centre for Cyber Security’s account of an investigated incident describes how firewall and HTTP access-log snapshots helped trace activity back to its beginning. Investigators also needed host and network evidence and analyzed custom payloads loaded in process memory. The Centre’s incident analysis illustrates why retaining more than web-server logs matters.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Review IIS and HTTP records for the initial request
Prioritize the ToolPane endpoint
Search for unusual HTTP POST requests to /_layouts/15/ToolPane.aspx. MITRE’s campaign record describes crafted POST requests to this endpoint as part of the activity. MITRE ATT&CK’s campaign entry adds behavioral context.
For each candidate request, inspect its timestamp, source and destination, URI, status code, user agent, request size or body if retained, and Referrer value. Compare these details with ordinary traffic for that farm and site. Empty or spoofed Referrer values have been noted in reported web-shell activity, but a header value is not proof of exploitation. Likewise, one suspicious POST is a lead to correlate, not a standalone verdict.
Correlate with upstream network records
Match the web-server event to firewall, proxy, or gateway records where possible. The Canadian Centre reported HTTPS access and exfiltration in its investigated incident; compromised network devices obscured the original source IPs, making IP-only hunting less useful. Treat source addresses as contextual pivots, not as the primary test or a complete blocklist.
Search SharePoint layout directories for unexpected files
Inspect relevant SharePoint TEMPLATELAYOUTS locations across the farm for unexpected files. Microsoft’s Defender XDR hunt names these examples:
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesspinstallandspupdateSpLogoutLayoutandSP.UI.TitleViewqueryruleaddtoolandClientId
Microsoft highlights spinstall0.aspx as an artifact indicating successful post-exploitation of CVE-2025-53770. For each match, record the exact path, creation time, hash, and available evidence about the process that created or modified it. The named files are hunt leads, not an exhaustive signature set; compare them with the farm’s expected files and change history. Microsoft’s article includes the related query examples: ToolShell hunting guidance.
Rank #3
- Made in USA - Proudly produced in Ohio by a Veteran-owned business
- Comprehensive Coverage: This BookFactory log book includes essential fields such as post/shift, time of change, date, weather conditions, and a designated space for detailed notes. This ensures that all relevant information is captured and easily accessible.
- Sturdy Cover: The trans-lux cover protects the log book from wear and tear, ensuring its longevity and maintaining the integrity of your recorded data.
- Essential Security Tool: This log book is an indispensable tool for any organization that values security and accountability. It helps to prevent misunderstandings, improve communication, and ensure a smooth transition between shifts.
- Wire-O with Trans-lux cover, 100 Pages, Dimensions 8.5" x 11" - (Security-Pass-Down) Reorder SKU: LOG-100-7CW-PP(Security-Pass-Down)
Correlate files, IIS worker processes, and Defender alerts
Review endpoint telemetry around the suspicious request and file timestamps. Microsoft’s query looks for w3wp.exe spawning cmd.exe or PowerShell with encoded-command indicators such as EncodedCommand or -ec; it decodes candidate strings and checks for shell names and SharePoint layout paths. Examine the full process tree, command line, account, timestamp, and any resulting network connections rather than relying on a matching string alone.
Microsoft also supplies file-event queries for suspicious files created by PowerShell and recommends checking related Defender alerts. Alert names and availability can change, so verify them in the current Defender portal and documentation. The customer advisory names these detections:
Exploit:Script/SuspSignoutReq.ATrojan:Win32/HijackSharePointServer.AExploit:Script/SuspSignoutReqBody.ATrojan:PowerShell/MachineKeyFinder.DA!amsi
Relevant alert titles include possible web-shell installation, possible exploitation of SharePoint server vulnerabilities, suspicious IIS worker-process behavior, and an IIS worker process loading a suspicious .NET assembly. An alert title can be triggered by unrelated activity: validate it against the server, process, file, and network evidence. Microsoft’s customer guidance lists the named detections.
Look for in-memory payloads and activity beyond SharePoint
Do not treat the absence of spinstall0.aspx or an IIS-spawned PowerShell process as a clean bill of health. In the Canadian Centre’s investigated incident, neither that file (nor a variation) nor an IIS-spawned PowerShell process was observed. Instead, the actor used custom .NET payloads loaded directly into IIS process memory.
Reported modules in that incident intercepted web requests, extracted cryptographic configuration, read the SAM database, performed SMB reconnaissance, crawled filesystems, and queried LDAP. Use those behaviors to widen the investigation when your telemetry supports it:
- Investigate unusual IIS modules or assemblies and memory-focused endpoint detections where available.
- Correlate unexpected SMB connections, LDAP queries, and activity on adjacent IIS or internal servers.
- Look for evidence of credential or key exposure, lateral movement, and outbound HTTPS transfer.
The same incident documented lateral movement and HTTPS exfiltration, showing that an investigation may need to extend beyond the initially exploited SharePoint host. The Canadian Centre’s analysis describes these findings.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Use indicators and campaign techniques carefully
Microsoft’s July 22, 2025 threat-intelligence article, updated July 23, includes examples of historical domains, IP addresses, file hashes, and Defender and Sentinel queries. Use those indicators as dated pivots against the DNS, network-session, web-session, and file-event data you actually retain. Keep the indicator source and date in case notes; a match needs context, and the article does not establish that every listed infrastructure indicator remains active. Validate against current Microsoft guidance and your organization’s threat intelligence before attributing activity to a particular actor or campaign.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →MITRE’s campaign entry records techniques including exploitation of public-facing applications, encoded PowerShell and command-shell use, web shells, collection of machine-key data, lateral movement, and ransomware activity. These are useful prompts for extending a hunt when evidence supports them, not a checklist that every ToolShell intrusion must satisfy.
How to judge the evidence
Confidence rises when independent sources support the same sequence—for example, a suspicious ToolPane POST followed by an unexpected layout-file change, a related IIS worker-process anomaly, and a matching network connection. A single unusual header, file name, alert, or IP match is weaker and needs validation. Record both supporting evidence and logging gaps: the absence of an event is meaningful only if the relevant source was enabled, retained, and covered the time under investigation.
Organize findings by attack stage so the investigation does not stop at the first visible artifact:
- Initial request: IIS and upstream HTTP records, including the ToolPane endpoint.
- File or process change: layout-directory files, process ancestry, command lines, and Defender findings.
- Post-exploitation: IIS modules, in-memory activity, key or credential access, and file-system discovery.
- Movement and impact: SMB and LDAP activity, adjacent systems, and possible data transfer.
Patch, mitigate, and recover across the farm
Microsoft recommends using supported on-premises SharePoint versions, applying the latest security updates, deploying endpoint protection, enabling and correctly configuring AMSI, rotating SharePoint ASP.NET machine keys, and restarting IIS on all SharePoint servers after the relevant changes. Use Microsoft’s current instructions and account for the whole farm; its guidance includes the PowerShell commands Set-SPMachineKey and Update-SPMachineKey for key generation and deployment.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Microsoft advises that if AMSI cannot be enabled before updating, isolate the server from the internet where possible or restrict unauthenticated traffic through an authenticated VPN, proxy, or gateway. Its guidance specifies AMSI Full Mode where HTTP request-body scanning is available. Confirm the current prerequisites and procedure in Microsoft’s customer guidance before making changes.
If evidence indicates compromise, preserve relevant logs and endpoint evidence, assess the entire farm and connected systems, and follow your organization’s incident-response process to establish scope and recovery. Include possible persistence, key exposure, credential misuse, and lateral movement in that assessment rather than treating removal of one named file as closure.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
