{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/sharepoint-toolshell-cve-2025-53770-49704-amsi-machine-key-rotation-iis/", "item": { "id": "https://update.dsesecurity.com/updates/sharepoint-toolshell-cve-2025-53770-49704-amsi-machine-key-rotation-iis/", "slug": "sharepoint-toolshell-cve-2025-53770-49704-amsi-machine-key-rotation-iis", "url": "https://update.dsesecurity.com/updates/sharepoint-toolshell-cve-2025-53770-49704-amsi-machine-key-rotation-iis/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/sharepoint-toolshell-cve-2025-53770-49704-amsi-machine-key-rotation-iis.md", "json": "https://update.dsesecurity.com/api/v1/posts/sharepoint-toolshell-cve-2025-53770-49704-amsi-machine-key-rotation-iis/" }, "title": "SharePoint ToolShell: patch on-premises servers, turn on AMSI, rotate ASP.NET machine keys and restart IIS", "summary": "CISA says the ToolShell chain, CVE-2025-49706 and CVE-2025-49704, gives attackers access to on-premises SharePoint content and code execution, with webshells, DLL payloads and Warlock ransomware observed. Its steps are to apply Microsoft’s updates, enable AMSI with antivirus and EDR, rotate ASP.NET machine keys before and after patching, and restart IIS.", "format": { "slug": "playbook", "name": "Playbook" }, "priority": { "slug": "important", "name": "Important" }, "featured": false, "image": { "theme": "identity-cloud", "label": "Identity & cloud", "alt": "Governed cloud identity system with connected service and lifecycle nodes.", "card_url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-10-19T00:28:02+00:00", "modified_at": "2026-10-19T01:55:07+00:00", "reviewed_on": "2026-10-19", "reading_minutes": 2, "word_count": 400, "potentially_affected": "Organizations running SharePoint Server on premises, especially internet-facing farms, and the administrators and providers who maintain them.", "dse_recommendation": "DSE recommends confirming every on-premises SharePoint server has Microsoft’s ToolShell updates, AMSI and endpoint protection, and rotated machine keys, then hunting for signs of earlier compromise.", "primary_source": { "name": "CISA — UPDATE: Microsoft Releases Guidance on Exploitation of SharePoint Vulnerabilities", "url": "https://www.cisa.gov/news-events/alerts/2025/07/20/update-microsoft-releases-guidance-exploitation-sharepoint-vulnerabilities", "published_on": null, "authority": "Cybersecurity and Infrastructure Security Agency" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

CISA says the ToolShell chain, CVE-2025-49706 and CVE-2025-49704, gives attackers access to on-premises SharePoint content and code execution, with webshells, DLL payloads and Warlock ransomware observed. Its steps are to apply Microsoft’s updates, enable AMSI with antivirus and EDR, rotate ASP.NET machine keys before and after patching, and restart IIS.

\n

Source facts

\n

CISA’s alert on SharePoint exploitation, last revised August 6, 2025, describes active exploitation of a spoofing and remote code execution chain, CVE-2025-49706 and CVE-2025-49704, publicly reported as ToolShell, that lets attackers fully access SharePoint content, including file systems and internal configurations, and execute code over the network on on-premises servers. It says .dll payloads have been observed alongside webshells, that attackers have also distributed Warlock ransomware, and that CVE-2025-53771 and CVE-2025-53770 are patch bypasses for those two flaws.

\n

CISA recommends applying Microsoft’s security updates, configuring the Antimalware Scan Interface in SharePoint with antivirus on all SharePoint servers, deploying EDR, and disconnecting public-facing servers from the internet if AMSI cannot be enabled. It says to rotate ASP.NET machine keys, apply the update, rotate the keys again and restart IIS with iisreset.exe, and warns that malicious module entries left in applicationHost.config and web.config will persist and reload when IIS restarts.

\n

It also says to disconnect public-facing SharePoint versions that have reached end of life or end of service, to monitor for POST requests to /_layouts/15/ToolPane.aspx?DisplayMode=Edit and requests with the referrer /_layouts/SignOut.aspx, and to audit and minimize layout and admin privileges.

\n

Applicability

\n

Use this for SharePoint Server installed on premises or on self-managed servers; CISA’s alert concerns on-premises SharePoint servers. Follow Microsoft’s advisories for the exact updates that apply to each SharePoint version.

\n

DSE recommendation

\n

DSE recommends confirming every on-premises SharePoint server has Microsoft’s ToolShell updates, AMSI and endpoint protection, and rotated machine keys, then hunting for signs of earlier compromise. Remove SharePoint from direct internet exposure where possible, check IIS configuration files for unknown modules, review web logs for the ToolPane and SignOut patterns, and plan replacement of any server past end of support.

\n

Verification

\n

Record each farm’s build number against Microsoft’s fixed versions, confirm AMSI status and the machine key rotation date, and keep the log review results with the incident file.

\n

Official reference

\n

CISA — UPDATE: Microsoft Releases Guidance on Exploitation of SharePoint Vulnerabilities. Reviewed October 19, 2026.

", "content_text": "CISA says the ToolShell chain, CVE-2025-49706 and CVE-2025-49704, gives attackers access to on-premises SharePoint content and code execution, with webshells, DLL payloads and Warlock ransomware observed. Its steps are to apply Microsoft’s updates, enable AMSI with antivirus and EDR, rotate ASP.NET machine keys before and after patching, and restart IIS.\nSource facts\nCISA’s alert on SharePoint exploitation, last revised August 6, 2025, describes active exploitation of a spoofing and remote code execution chain, CVE-2025-49706 and CVE-2025-49704, publicly reported as ToolShell, that lets attackers fully access SharePoint content, including file systems and internal configurations, and execute code over the network on on-premises servers. It says .dll payloads have been observed alongside webshells, that attackers have also distributed Warlock ransomware, and that CVE-2025-53771 and CVE-2025-53770 are patch bypasses for those two flaws.\nCISA recommends applying Microsoft’s security updates, configuring the Antimalware Scan Interface in SharePoint with antivirus on all SharePoint servers, deploying EDR, and disconnecting public-facing servers from the internet if AMSI cannot be enabled. It says to rotate ASP.NET machine keys, apply the update, rotate the keys again and restart IIS with iisreset.exe, and warns that malicious module entries left in applicationHost.config and web.config will persist and reload when IIS restarts.\nIt also says to disconnect public-facing SharePoint versions that have reached end of life or end of service, to monitor for POST requests to /_layouts/15/ToolPane.aspx?DisplayMode=Edit and requests with the referrer /_layouts/SignOut.aspx, and to audit and minimize layout and admin privileges.\nApplicability\nUse this for SharePoint Server installed on premises or on self-managed servers; CISA’s alert concerns on-premises SharePoint servers. Follow Microsoft’s advisories for the exact updates that apply to each SharePoint version.\nDSE recommendation\nDSE recommends confirming every on-premises SharePoint server has Microsoft’s ToolShell updates, AMSI and endpoint protection, and rotated machine keys, then hunting for signs of earlier compromise. Remove SharePoint from direct internet exposure where possible, check IIS configuration files for unknown modules, review web logs for the ToolPane and SignOut patterns, and plan replacement of any server past end of support.\nVerification\nRecord each farm’s build number against Microsoft’s fixed versions, confirm AMSI status and the machine key rotation date, and keep the log review results with the incident file.\nOfficial reference\nCISA — UPDATE: Microsoft Releases Guidance on Exploitation of SharePoint Vulnerabilities. Reviewed October 19, 2026.", "content_markdown": "CISA says the ToolShell chain, CVE-2025-49706 and CVE-2025-49704, gives attackers access to on-premises SharePoint content and code execution, with webshells, DLL payloads and Warlock ransomware observed. Its steps are to apply Microsoft’s updates, enable AMSI with antivirus and EDR, rotate ASP.NET machine keys before and after patching, and restart IIS.\n\n## Source facts\n\nCISA’s [alert on SharePoint exploitation](https://www.cisa.gov/news-events/alerts/2025/07/20/update-microsoft-releases-guidance-exploitation-sharepoint-vulnerabilities), last revised August 6, 2025, describes active exploitation of a spoofing and remote code execution chain, CVE-2025-49706 and CVE-2025-49704, publicly reported as ToolShell, that lets attackers fully access SharePoint content, including file systems and internal configurations, and execute code over the network on on-premises servers. It says .dll payloads have been observed alongside webshells, that attackers have also distributed Warlock ransomware, and that CVE-2025-53771 and CVE-2025-53770 are patch bypasses for those two flaws.\n\nCISA recommends applying Microsoft’s security updates, configuring the Antimalware Scan Interface in SharePoint with antivirus on all SharePoint servers, deploying EDR, and disconnecting public-facing servers from the internet if AMSI cannot be enabled. It says to rotate ASP.NET machine keys, apply the update, rotate the keys again and restart IIS with iisreset.exe, and warns that malicious module entries left in applicationHost.config and web.config will persist and reload when IIS restarts.\n\nIt also says to disconnect public-facing SharePoint versions that have reached end of life or end of service, to monitor for POST requests to /_layouts/15/ToolPane.aspx?DisplayMode=Edit and requests with the referrer /_layouts/SignOut.aspx, and to audit and minimize layout and admin privileges.\n\n## Applicability\n\nUse this for SharePoint Server installed on premises or on self-managed servers; CISA’s alert concerns on-premises SharePoint servers. Follow Microsoft’s advisories for the exact updates that apply to each SharePoint version.\n\n## DSE recommendation\n\nDSE recommends confirming every on-premises SharePoint server has Microsoft’s ToolShell updates, AMSI and endpoint protection, and rotated machine keys, then hunting for signs of earlier compromise. Remove SharePoint from direct internet exposure where possible, check IIS configuration files for unknown modules, review web logs for the ToolPane and SignOut patterns, and plan replacement of any server past end of support.\n\n## Verification\n\nRecord each farm’s build number against Microsoft’s fixed versions, confirm AMSI status and the machine key rotation date, and keep the log review results with the incident file.\n\n## Official reference\n\n[CISA — UPDATE: Microsoft Releases Guidance on Exploitation of SharePoint Vulnerabilities](https://www.cisa.gov/news-events/alerts/2025/07/20/update-microsoft-releases-guidance-exploitation-sharepoint-vulnerabilities). Reviewed October 19, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/sharepoint-toolshell-cve-2025-53770-49704-amsi-machine-key-rotation-iis/", "url": "https://update.dsesecurity.com/updates/sharepoint-toolshell-cve-2025-53770-49704-amsi-machine-key-rotation-iis/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-19" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/sharepoint-toolshell-cve-2025-53770-49704-amsi-machine-key-rotation-iis/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "SharePoint ToolShell: patch on-premises servers, turn on AMSI, rotate ASP.NET machine keys and restart IIS", "item": "https://update.dsesecurity.com/updates/sharepoint-toolshell-cve-2025-53770-49704-amsi-machine-key-rotation-iis/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/sharepoint-toolshell-cve-2025-53770-49704-amsi-machine-key-rotation-iis/#article", "identifier": "https://update.dsesecurity.com/updates/sharepoint-toolshell-cve-2025-53770-49704-amsi-machine-key-rotation-iis/", "url": "https://update.dsesecurity.com/updates/sharepoint-toolshell-cve-2025-53770-49704-amsi-machine-key-rotation-iis/", "headline": "SharePoint ToolShell: patch on-premises servers, turn on AMSI, rotate ASP.NET machine keys and restart IIS", "description": "CISA says the ToolShell chain, CVE-2025-49706 and CVE-2025-49704, gives attackers access to on-premises SharePoint content and code execution, with…", "abstract": "CISA says the ToolShell chain, CVE-2025-49706 and CVE-2025-49704, gives attackers access to on-premises SharePoint content and code execution, with webshells, DLL payloads and Warlock ransomware observed. Its steps are to apply Microsoft’s updates, enable AMSI with antivirus and EDR, rotate ASP.NET machine keys before and after patching, and restart IIS.", "articleBody": "CISA says the ToolShell chain, CVE-2025-49706 and CVE-2025-49704, gives attackers access to on-premises SharePoint content and code execution, with webshells, DLL payloads and Warlock ransomware observed. Its steps are to apply Microsoft’s updates, enable AMSI with antivirus and EDR, rotate ASP.NET machine keys before and after patching, and restart IIS.\nSource facts\nCISA’s alert on SharePoint exploitation, last revised August 6, 2025, describes active exploitation of a spoofing and remote code execution chain, CVE-2025-49706 and CVE-2025-49704, publicly reported as ToolShell, that lets attackers fully access SharePoint content, including file systems and internal configurations, and execute code over the network on on-premises servers. It says .dll payloads have been observed alongside webshells, that attackers have also distributed Warlock ransomware, and that CVE-2025-53771 and CVE-2025-53770 are patch bypasses for those two flaws.\nCISA recommends applying Microsoft’s security updates, configuring the Antimalware Scan Interface in SharePoint with antivirus on all SharePoint servers, deploying EDR, and disconnecting public-facing servers from the internet if AMSI cannot be enabled. It says to rotate ASP.NET machine keys, apply the update, rotate the keys again and restart IIS with iisreset.exe, and warns that malicious module entries left in applicationHost.config and web.config will persist and reload when IIS restarts.\nIt also says to disconnect public-facing SharePoint versions that have reached end of life or end of service, to monitor for POST requests to /_layouts/15/ToolPane.aspx?DisplayMode=Edit and requests with the referrer /_layouts/SignOut.aspx, and to audit and minimize layout and admin privileges.\nApplicability\nUse this for SharePoint Server installed on premises or on self-managed servers; CISA’s alert concerns on-premises SharePoint servers. Follow Microsoft’s advisories for the exact updates that apply to each SharePoint version.\nDSE recommendation\nDSE recommends confirming every on-premises SharePoint server has Microsoft’s ToolShell updates, AMSI and endpoint protection, and rotated machine keys, then hunting for signs of earlier compromise. Remove SharePoint from direct internet exposure where possible, check IIS configuration files for unknown modules, review web logs for the ToolPane and SignOut patterns, and plan replacement of any server past end of support.\nVerification\nRecord each farm’s build number against Microsoft’s fixed versions, confirm AMSI status and the machine key rotation date, and keep the log review results with the incident file.\nOfficial reference\nCISA — UPDATE: Microsoft Releases Guidance on Exploitation of SharePoint Vulnerabilities. Reviewed October 19, 2026.", "datePublished": "2026-10-19T00:28:02+00:00", "dateModified": "2026-10-19T01:55:07+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/sharepoint-toolshell-cve-2025-53770-49704-amsi-machine-key-rotation-iis/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/sharepoint-toolshell-cve-2025-53770-49704-amsi-machine-key-rotation-iis/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/identity-cloud-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "SharePoint ToolShell: patch on-premises servers, turn on AMSI, rotate ASP.NET machine keys and restart IIS" }, "articleSection": [ "Cybersecurity", "IT" ], "keywords": [ "Cybersecurity", "IT", "Playbook", "Important priority" ], "genre": "Playbook", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 400, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "CISA — UPDATE: Microsoft Releases Guidance on Exploitation of SharePoint Vulnerabilities", "url": "https://www.cisa.gov/news-events/alerts/2025/07/20/update-microsoft-releases-guidance-exploitation-sharepoint-vulnerabilities" } } ] } }