Threat video1:00
CVE-2025-53770 SharePoint Storm-2603: Detection & IOCs
Storm-2603 hides a webshell in IIS w3wp.exe via ToolShell, then drops Warlock ransomware. The free Splunk SPL rule leads 9 detection rules and 30 IOCs.
Read the full threat intel for CVE-2025-53770 SharePoint Storm-2603: Detection & IOCs →
Chapters
- 0:00The hook16 attack techniques, fileless SharePoint breach.
- 0:04The storyIn December, attackers deployed a fileless webshell.
- 0:10Attack pathReconnaissance, then remote code execution achieved.
- 0:26AttributionAttributed to Storm-2603.
- 0:32Indicators of compromise28 indicators to hunt: 10 IPs, 2 domains and 3 URLs, and more.
- 0:38MITRE ATT&CK techniques16 ATT&CK techniques, from initial access to command and control.
- 0:44Remediation5 steps now: Apply Microsoft SharePoint security updates.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:0016 attack techniques, fileless SharePoint breach.
0:05In December, attackers deployed a fileless webshell.
0:10Reconnaissance, then remote code execution achieved.
0:14C# webshell loads, fileless, memory-only.
0:17Escalated privileges enabled Velociraptor, Zoho Assist.
0:21Vulnerable driver staged to kill EDR.
0:26Attributed to Storm-2603. Confidence: medium.
0:3228 indicators to hunt: 10 IPs, 2 domains and 3 URLs, and more.
0:3916 ATT&CK techniques, from initial access to command and control.
0:445 steps now: Apply Microsoft SharePoint security updates.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.