Detect Microsoft SharePoint Server Improper Input Validation (CVE-2026-32201) in IBM QRadar
Detects exploitation of CVE-2026-32201, an improper input validation vulnerability in Microsoft SharePoint Server. This vulnerability is actively exploited in the wild (CISA KEV) and allows attackers to send crafted HTTP requests to SharePoint endpoints to bypass input validation controls, potentially enabling unauthorized access, remote code execution, or data exfiltration. CWE-20 class vulnerabilities in SharePoint have historically been leveraged for initial access and lateral movement in enterprise environments.
MITRE ATT&CK
QRadar Detection Query
SELECT sourceip, URL, username, "HTTPRequestMethod", "HTTPStatusCode", QIDNAME(qid) AS EventName, COUNT(*) AS EventCount
FROM events
WHERE LOGSOURCETYPENAME(devicetype) IN ('Microsoft IIS', 'Microsoft SharePoint')
AND (URL ILIKE '%/_layouts/%' OR URL ILIKE '%/_api/%' OR URL ILIKE '%/_vti_bin/%' OR URL ILIKE '%/sites/%')
AND (
("HTTPRequestMethod" IN ('POST', 'PUT', 'PATCH') AND (
URL ILIKE '%../%' OR URL ILIKE '%%2e%2e%' OR URL ILIKE '%%00%'
OR URL ILIKE '%<script%' OR URL ILIKE '%javascript:%'
))
OR "HTTPStatusCode" >= 500
)
AND DATEFORMAT(starttime, 'yyyy-MM-dd HH:mm:ss') > DATEADD('hour', -24, NOW())
GROUP BY sourceip, URL, username, "HTTPRequestMethod", "HTTPStatusCode", qid
HAVING COUNT(*) > 5
ORDER BY EventCount DESC
LIMIT 1000QRadar AQL query identifying suspicious SharePoint HTTP requests matching CVE-2026-32201 exploitation patterns, including encoded path traversal sequences and input validation bypass payloads, grouped by source IP for correlation.
Data Sources
Required Tables
False Positives & Tuning
- SharePoint online migration tools that use non-standard URL encoding
- Legitimate API clients that include special characters in request parameters
- Internal security tools performing routine SharePoint vulnerability assessments
- CDN edge nodes forwarding requests with encoded characters from legitimate users
Other platforms for CVE-2026-32201
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1SharePoint Encoded Path Traversal Probe (CVE-2026-32201)
Expected signal: IIS W3C log entry with cs-uri-stem=/_layouts/15/start.aspx, cs-uri-query containing %2e%2e%2f, cs-method=POST, and HTTP status 400 or 500 (or 200 if vulnerable). Network connection event from test host to SharePoint server on TCP/80 or TCP/443.
- Test 2SharePoint REST API Null Byte Injection (CVE-2026-32201)
Expected signal: 10 IIS log entries to /_api/web/lists with POST method, JSON content-type, and null byte (%00) in request body. Windows Security Event 4688 should NOT appear unless RCE achieved. HTTP 400/401/403/500 expected in non-vulnerable or patched environments.
- Test 3SharePoint Webshell Drop via Exploited Upload Endpoint (CVE-2026-32201 Post-Exploitation Simulation)
Expected signal: Windows Security Event 4663 (File System Audit) for new .aspx file creation in SharePoint _layouts directory by process other than normal SharePoint setup. Sysmon Event ID 11 (FileCreate) with TargetFilename matching *.aspx in SharePoint web root paths. IIS log entry for GET request to /_layouts/15/detection_test_cve_2026_32201.aspx returning HTTP 200.
- Test 4High-Volume SharePoint Endpoint Fuzzing (CVE-2026-32201 Scanner Simulation)
Expected signal: 32+ IIS log entries across 4 SharePoint endpoints within ~7 seconds from single source IP. Encoded traversal sequences visible in cs-uri-query fields. Mix of HTTP 400, 403, 404, and 500 response codes expected.
Response Playbook
Triage
- Identify the source IP(s) triggering the alert and determine geolocation, ASN, and whether the IP appears in threat intelligence feeds (VirusTotal, Shodan, AbuseIPDB). Cross-reference against VPN/proxy lists.
- Review IIS access logs on the affected SharePoint server for the full URI path, query string, request body size, and HTTP response codes associated with the suspicious requests. Look for 200 OK responses to encoded traversal paths as a high-confidence exploitation indicator.
- Determine the targeted SharePoint endpoint (/_layouts/, /_api/, /_vti_bin/) and assess whether the endpoint is publicly accessible or requires authentication. Check if the requests bypassed authentication (anonymous access returning 200).
- Correlate with SharePoint ULS (Unified Logging Service) logs at %COMMONPROGRAMFILES%\Microsoft Shared\Web Server Extensions\16\LOGS\ for application-level errors or unexpected exception traces coinciding with the HTTP anomalies.
- Check Windows Security Event Logs (Event ID 4688 — Process Creation) on the SharePoint server for w3wp.exe spawning unusual child processes (cmd.exe, powershell.exe, cscript.exe) which would indicate successful RCE.
Containment
- Immediately block the offending source IP(s) at the perimeter firewall and Web Application Firewall (WAF) if exploitation is confirmed or strongly suspected. Enable WAF rules specifically targeting CVE-2026-32201 payload signatures.
- If successful exploitation is confirmed (child process spawned, unauthorized file written, data accessed), isolate the SharePoint server from the network using CrowdStrike network containment or equivalent EDR capability while preserving forensic state. Do not power off — maintain volatile memory.
- Revoke all active SharePoint sessions and force re-authentication for all users. Rotate service account credentials used by the SharePoint application pool identity.
- Apply Microsoft's security patch for CVE-2026-32201 immediately. If patching is not immediately possible, implement URL Request Filtering in IIS to block requests containing known exploit paystrings (%2e%2e, %00, encoded script tags).
Evidence Collection
- Collect IIS access logs (W3C format) from the affected SharePoint server covering at least 72 hours prior to detection. Preserve in read-only storage with SHA-256 hash verification. Include W3SVC logs from %SystemDrive%\inetpub\logs\LogFiles\.
- Capture SharePoint ULS logs, Windows Application and System event logs, Windows Security event logs (focus on Event IDs 4624, 4625, 4688, 4697, 7045), and any available memory dump using tools such as WinPmem or Task Manager (not suitable for production — use approved forensic tooling).
- Export WAF/perimeter firewall logs showing all traffic to/from the SharePoint server's public IP for the incident timeframe, including blocked and allowed connections.
Escalation Criteria
- !Escalate immediately to Incident Response if IIS worker process (w3wp.exe) is observed spawning shell processes, if webshells are discovered in the SharePoint web root or _layouts directory, or if lateral movement indicators are detected from the SharePoint server to internal hosts.
- !Escalate if the vulnerability was exploited by an authenticated user account (indicating credential compromise in addition to CVE exploitation) or if exfiltration of SharePoint document libraries, lists, or site collections is detected via anomalous outbound data transfers.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
IIS W3C access logs at %SystemDrive%\inetpub\logs\LogFiles\W3SVC* — review for anomalous URI patterns, encoded sequences, and POST requests to SharePoint endpoints returning 200 OK - >
SharePoint ULS logs at %COMMONPROGRAMFILES%\Microsoft Shared\Web Server Extensions\16\LOGS\ — look for CriticalUnhandledException or Security-related correlation IDs matching suspicious request timestamps - >
Windows Security Event Log — Event ID 4688 (Process Creation) for w3wp.exe spawning cmd.exe or powershell.exe; Event ID 4697 (Service Installed) for persistence mechanisms - >
File system artifacts: new .aspx, .asmx, or .ashx files in SharePoint web root (C:\inetpub\wwwroot\wss\), /_layouts/ directories, or App_Data folders indicating webshell drops - >
Registry key HKLM\SYSTEM\CurrentControlSet\Services\ for newly created services post-exploitation; scheduled tasks in %SystemRoot%\System32\Tasks\
Tuning Guidance
Start with the 5-minute time window and a threshold of 20+ requests from a single IP. In environments with large SharePoint farms, increase the threshold to 50-100 requests and tighten the filter to only include requests containing encoded sequences (%2e%2e, %00) in POST/PUT bodies rather than all anomalous URI patterns. Whitelist known SharePoint crawlers, SharePoint Online hybrid connector IPs, and internal monitoring system IPs. For organizations using Azure Application Gateway or third-party WAF in front of SharePoint, IIS logs may show WAF egress IPs rather than true client IPs — configure X-Forwarded-For header parsing. Consider reducing the severity to 'high' for environments where SharePoint is not internet-facing, as exploitation requires network access to the SharePoint endpoint.
Hunting Queries
Threat hunt for successful SharePoint requests (HTTP 200) containing encoded traversal or injection payloads — a strong indicator of CVE-2026-32201 exploitation resulting in valid server responses rather than errors.
W3CIISLog
| where TimeGenerated >= ago(30d)
| where csUriStem has_any ("/_layouts/", "/_api/", "/_vti_bin/")
| where csMethod in~ ("POST", "PUT", "PATCH")
| where scStatus == 200
| where csUriQuery has_any ("%2e", "%00", "../", "javascript", "<script")
| project TimeGenerated, cIP, csUriStem, csUriQuery, scStatus, scBytes, csUserAgent
| sort by TimeGenerated descindex=iis sourcetype=iis method IN ("POST","PUT","PATCH") status=200
| where match(uri_path, "(?i)/_layouts/|/_api/|/_vti_bin/")
| where match(uri_query, "(?i)%2e%2e|%00|\.\.\/?|javascript:|<script")
| table _time, src_ip, uri_path, uri_query, status, bytes, useragent
| sort -_timeHunt for IIS worker process (w3wp.exe) spawning command interpreters, which would indicate successful code execution following CVE-2026-32201 exploitation on the SharePoint server.
SecurityEvent
| where TimeGenerated >= ago(7d)
| where EventID == 4688
| where ParentProcessName has "w3wp.exe"
| where NewProcessName has_any ("cmd.exe", "powershell.exe", "cscript.exe", "wscript.exe", "mshta.exe", "certutil.exe", "bitsadmin.exe")
| project TimeGenerated, Computer, ParentProcessName, NewProcessName, CommandLine, SubjectUserName
| sort by TimeGenerated descindex=wineventlog EventCode=4688 ParentProcessName="*w3wp.exe*"
| where ProcessName IN ("*cmd.exe*","*powershell.exe*","*cscript.exe*","*wscript.exe*","*mshta.exe*")
| table _time, host, ParentProcessName, ProcessName, CommandLine, user
| sort -_timeAtomic Red Team Tests
Simulates CVE-2026-32201 exploitation by sending a crafted POST request to a SharePoint /_layouts/ endpoint with double-encoded path traversal sequences in the URI query string to test input validation bypass.
Command
curl -sk -X POST 'http://SHAREPOINT_HOST/_layouts/15/start.aspx?ReturnUrl=%2e%2e%2f%2e%2e%2fwindows%2fwin.ini' -H 'Content-Type: application/x-www-form-urlencoded' -H 'User-Agent: Mozilla/5.0 (compatible; lab-test)' -d '__VIEWSTATE=test&__REQUESTDIGEST=0x0' -o /tmp/sp_response.txt -w 'HTTP_STATUS:%{http_code}\nSIZE:%{size_download}\n'; echo '[*] Response saved to /tmp/sp_response.txt'Cleanup
rm -f /tmp/sp_response.txtExpected Telemetry
IIS W3C log entry with cs-uri-stem=/_layouts/15/start.aspx, cs-uri-query containing %2e%2e%2f, cs-method=POST, and HTTP status 400 or 500 (or 200 if vulnerable). Network connection event from test host to SharePoint server on TCP/80 or TCP/443.
Expected Detection
Alert triggered by KQL/SPL rule on encoded traversal sequence (%2e%2e) in POST request to /_layouts/ path. Chronicle YARA-L rule should fire within the 2-minute window if threshold of 5 events is met.
Tests input validation bypass via null byte injection in SharePoint REST API endpoint parameters, simulating the CWE-20 class vulnerability exploited by CVE-2026-32201.
Command
for i in $(seq 1 10); do curl -sk -X POST 'http://SHAREPOINT_HOST/_api/web/lists' -H 'Accept: application/json;odata=verbose' -H 'Content-Type: application/json;odata=verbose' -H 'X-RequestDigest: 0x0' -d '{"__metadata":{"type":"SP.List"},"Title":"test%00admin","BaseTemplate":100}' -w 'Attempt '$i': HTTP:%{http_code}\n' -o /dev/null; sleep 1; doneCleanup
No persistent artifacts created; all requests return server-side errors in lab environment.Expected Telemetry
10 IIS log entries to /_api/web/lists with POST method, JSON content-type, and null byte (%00) in request body. Windows Security Event 4688 should NOT appear unless RCE achieved. HTTP 400/401/403/500 expected in non-vulnerable or patched environments.
Expected Detection
Splunk SPL rule fires on suspicious_count threshold after 5+ requests containing %00 to /_api/ endpoint. QRadar AQL query groups events by src_ip with count > 5 within 24-hour window.
Simulates post-exploitation webshell staging that may follow successful CVE-2026-32201 exploitation, using a benign ASPX test file upload to a SharePoint document library via the /_vti_bin/ endpoint to validate detection of unauthorized file creation.
Command
# Run on SharePoint server with local admin rights (lab only)
$webshellContent = '<%@ Page Language="C#" %><% Response.Write("DETECTION_TEST_" + DateTime.Now.ToString()); %>'
$targetPath = 'C:\inetpub\wwwroot\wss\VirtualDirectories\80\_layouts\15\detection_test_cve_2026_32201.aspx'
Set-Content -Path $targetPath -Value $webshellContent -Encoding UTF8
Write-Host "[*] Test file written to: $targetPath"
Start-Sleep -Seconds 5
# Attempt to access via HTTP
$response = Invoke-WebRequest -Uri 'http://localhost/_layouts/15/detection_test_cve_2026_32201.aspx' -UseBasicParsing -ErrorAction SilentlyContinue
Write-Host "[*] HTTP Response Code: $($response.StatusCode)"Cleanup
Remove-Item 'C:\inetpub\wwwroot\wss\VirtualDirectories\80\_layouts\15\detection_test_cve_2026_32201.aspx' -Force -ErrorAction SilentlyContinue; Write-Host '[*] Test file removed'Expected Telemetry
Windows Security Event 4663 (File System Audit) for new .aspx file creation in SharePoint _layouts directory by process other than normal SharePoint setup. Sysmon Event ID 11 (FileCreate) with TargetFilename matching *.aspx in SharePoint web root paths. IIS log entry for GET request to /_layouts/15/detection_test_cve_2026_32201.aspx returning HTTP 200.
Expected Detection
File integrity monitoring alert on new .aspx file in /_layouts/. CrowdStrike CQL event for FileCreate in SharePoint web directories. Hunt query for w3wp.exe child processes should show PowerShell.exe invocation (the test script itself) correlating the simulation chain.
Simulates an automated exploitation scanner probing multiple SharePoint endpoints with various encoded payloads in rapid succession, generating the volume-based detection triggers in the monitoring rules.
Command
PAYLOADS=("%2e%2e%2f%2e%2e%2fwindows%2fsystem32" "%00.aspx" "javascript:alert(1)" "<script>alert(1)</script>" "%2e%2e/web.config" "..%2f..%2fetc%2fpasswd" "%252e%252e%252f" "..;/admin")
ENDPOINTS=("/_layouts/15/" "/_api/web/" "/_vti_bin/" "/sites/default/")
for endpoint in "${ENDPOINTS[@]}"; do
for payload in "${PAYLOADS[@]}"; do
curl -sk -X POST "http://SHAREPOINT_HOST${endpoint}?test=${payload}" \
-H 'Content-Type: application/x-www-form-urlencoded' \
-d "data=${payload}" -o /dev/null -w "${endpoint}?test=${payload}: HTTP %{http_code}\n"
sleep 0.2
done
done
echo '[*] Fuzzing simulation complete'Cleanup
No persistent artifacts. All requests are stateless HTTP.Expected Telemetry
32+ IIS log entries across 4 SharePoint endpoints within ~7 seconds from single source IP. Encoded traversal sequences visible in cs-uri-query fields. Mix of HTTP 400, 403, 404, and 500 response codes expected.
Expected Detection
All seven SIEM queries should fire: KQL rule triggers on RequestCount > 20 from single IP in 5-minute window; SPL rule on suspicious_count > 5; Chronicle YARA-L on #e >= 5 events in 2 minutes; CrowdStrike CQL on attempt_count >= 3. Sumo Logic rule triggers on suspicious_count > 3.