What to Do After a SharePoint Server Compromise: Contain, Investigate, and Recover

If your on-premises SharePoint Server may have been compromised, treat it as an incident—not just a patching task. Preserve evidence, determine how far the attacker reached, contain access and exposed credentials, remove persistence, then rebuild or restore from a verified clean state. Installing updates is essential, but it does not prove that an attacker already inside has been removed.

1. Activate incident response and preserve evidence

Follow your organization’s incident-response plan and assign an incident owner. Record a timeline that includes discovery, suspected exposure, changes already made, patching, and containment actions. Coordinate security, SharePoint, Windows, network, identity, and database administrators so that changes to one part of the environment do not undermine investigation or recovery elsewhere.

#	Preview	Product	Price
1		Synology DS423 Family & Business Backup - Secure File Sharing, Photo Vault & Video Surveillance...	$399.99	Buy on Amazon

As an Amazon Associate I earn from qualifying purchases.

Before cleaning files, restarting services, or changing the server where feasible, preserve relevant logs and system state. The Cyber Security Agency of Singapore (CSA) advises determining the scope without prematurely changing system state, because changes may destroy forensic evidence. For high-value systems or investigations requiring deeper analysis, the CSA recommends taking a full disk image for offline examination, including deleted files and filesystem timelines. CSA’s July 24, 2025 guide addresses compromises related to CVE-2025-53770 and CVE-2025-53771.

• Preserve IIS, SharePoint Unified Logging Service (ULS), and Windows logs before their retention windows expire.
• Keep copies of relevant security, application, system, PowerShell Script Block Logging, and Sysmon logs where available.
• Record who collected each item, when it was collected, and any response action that could have altered the evidence.

2. Scope the farm and connected systems

Centralize the available logs and investigate the SharePoint servers, identities, and connected systems for signs of initial access, execution, persistence, credential theft, and lateral movement. Look for unusual IIS worker-process activity and suspicious files in SharePoint’s TEMPLATELAYOUTS directories, including web shells or files such as debug_dev.js.

#1 Best Overall

Synology DS423 Family & Business Backup - Secure File Sharing, Photo Vault & Video Surveillance (4-Bay Diskless NAS)

• Secure private cloud - Safely access and share files and media from anywhere, and keep friends, partners, or collaborators on the same page
• Comprehensive data protection - Back up your media and documents to multiple destinations, and leverage snapshots to protect against malware
• Versatile video surveillance - Protect your home or business with intuitive monitoring, archiving, and analysis tools for up to 30 IP cameras (need to purchase camera license separetly)
• File Server - Replace expensive SharePoint or Dropbox with local file sharing, team folders and permission contro
• Ransomware-Resistant Backup - Protect against malware with immutable snapshots, versioned files and multi-destination backup strategies

$399.99

Buy on Amazon

Check dated ToolShell indicators without treating them as a complete checklist

In activity covered by the CSA’s 2025 guide, investigators were advised to look for suspicious POST requests to /_layouts/15/ToolPane.aspx?DisplayMode=Edit with a Referer header of /_layouts/SignOut.aspx, followed by GET requests to web shells such as spinstall0.aspx and variants. The CSA also calls out anomalous requests from known malicious IP addresses. These are leads tied to the 2025 vulnerabilities, not proof that every SharePoint compromise will use them.

Microsoft’s July 2025 threat analysis describes observed use of the spinstall0.aspx web shell and variants, theft of ASP.NET machine-key data, scheduled-task persistence, suspicious IIS component loading, attempts to access credentials in LSASS, lateral movement, and ransomware deployment. Use the indicators in Microsoft’s analysis as dated hunting leads, not as a complete description of later activity. An indicator’s absence does not establish that a farm is clean.

Account for the newer 2026 alert

In its alert reviewed October 4, 2026, CISA reports active exploitation of CVE-2026-32201, CVE-2026-45659, and CVE-2026-56164 against supported on-premises SharePoint Server versions. The same alert lists CVE-2026-55040 and CVE-2026-58644 as newly disclosed potential risks not then known to be exploited. These statuses can change; consult CISA’s current alert for the latest scope, indicators, and mitigations. Do not assume the 2025 ToolShell indicators or guidance cover these 2026 vulnerabilities in full.

3. Contain attacker access and movement

Block known malicious IP addresses, domains, and file hashes at the appropriate network and endpoint controls. Assess whether to isolate a compromised or reasonably suspected server from the network to interrupt command-and-control or lateral movement. Balance containment with evidence preservation and business continuity; decide based on the incident, available evidence, and response plan rather than treating disconnection as an automatic step for every farm.

The CSA guide specifically recommends disconnecting from public and internal networks when patching is not possible or the installation is an end-of-support version. That recommendation is context-specific. If containment requires isolation, coordinate the action and document its timing and scope.

Reset credentials that may have been exposed

If credential dumping is evidenced or suspected, identify and reset potentially exposed credentials in a targeted, coordinated way. The CSA prioritizes SharePoint service accounts, local administrator accounts on the server, and domain administrator accounts that may have logged on to the compromised host. Investigate connected systems and identities as evidence indicates possible lateral movement. Microsoft’s 2025 analysis describes LSASS access and lateral movement in observed activity, but the relevant accounts and reset sequence depend on the incident.

4. Close the entry path and remove persistence

Confirm that the farm runs a supported SharePoint Server version and install the latest security updates applicable to that version. CISA’s October 4, 2026 alert calls for verifying that updates installed successfully and shortening patch cycles where possible. Patch status addresses known vulnerabilities; it does not by itself establish that a previously compromised server is free of an attacker or hidden persistence.

Harden SharePoint exposure and monitoring

CISA recommends enabling AMSI integration for every SharePoint web application, using Full Mode where feasible, and enabling detection and monitoring. Reduce direct internet exposure unless it is necessary; when external access is required, CISA recommends an authenticated Layer 7 reverse proxy or equivalent application-layer control. Restrict Central Administration from external access and limit farm and database communications to required systems. See CISA’s alert for its current recommendations.

Follow the applicable machine-key procedure in the right order

For the 2025 vulnerabilities covered by Microsoft’s analysis, Microsoft recommends enabling AMSI and Defender Antivirus, deploying Defender for Endpoint or an equivalent, rotating SharePoint ASP.NET machine keys, and restarting IIS on all SharePoint servers after the specified update or AMSI steps. CISA’s later alert warns that artifacts capable of stealing keys should be found and remediated before rotation; otherwise, an attacker may obtain the replacement keys. Confirm the current Microsoft and CISA instructions for the exact SharePoint version and vulnerability before rotating keys or restarting IIS. The 2025 procedure should not be assumed to cover a different 2026 attack chain.

5. Rebuild or restore from a verified clean state

For a confirmed compromise, the CSA strongly recommends a full rebuild to remove hidden backdoors, rootkits, or modifications that routine cleanup may miss. If rebuilding is not feasible, its alternative is a known-good, uncompromised backup from before the intrusion that has been verified clean. The choice is about confidence in eradication as well as service recovery—not simply which option is faster.

Plan recovery around the organization’s recovery point, recovery time, and recovery level objectives. Microsoft documents SharePoint Server farm restoration through Central Administration or PowerShell. A configuration-only backup cannot restore content databases together with configuration, and SQL Server tools alone cannot restore a complete SharePoint farm. Microsoft recommends configuring a recovery farm for site and item recovery. Consult Microsoft’s backup and recovery planning guidance and farm restoration documentation when designing the recovery procedure.

6. Validate before returning to service

Keep the rebuilt or restored environment under heightened monitoring while validating it. Confirm that the applicable updates and security controls are in place, review relevant logs for renewed suspicious activity, and verify that the recovered farm meets business recovery requirements before normal service resumes. Include connected systems and accounts in validation where the investigation found evidence of movement beyond SharePoint.

SharePoint Online is a different service scope: Microsoft’s 2025 article says the vulnerabilities it discusses do not affect SharePoint Online, while CISA’s current alert concerns on-premises SharePoint Server. Follow the advisory for the specific product and vulnerability involved.

Quick Recap

Bestseller No. 1

Synology DS423 Family & Business Backup - Secure File Sharing, Photo Vault & Video Surveillance (4-Bay Diskless NAS)

$399.99

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.