Microsoft SharePoint Weak Authentication Exploitation (CVE-2026-55040)

let sharepointHosts = dynamic([]);
let suspiciousPaths = dynamic(["/_layouts/15/ToolPane.aspx", "/_api/web", "/_vti_bin", "/_layouts/15/spinstalladmincomponent.aspx", "/_layouts/signout.aspx"]);
W3CIISLog
| where csUriStem has_any (suspiciousPaths) or csUriStem has "/_layouts/" or csUriStem has "/_api/"
| extend AuthHeader = tostring(column_ifexists("csAuthorization", ""))
| where (scStatus in (200, 302) and (csMethod == "POST")) and (isempty(csUsername) or csUsername == "-")
| project TimeGenerated, sSiteName, sComputerName, cIP, csMethod, csUriStem, csUriQuery, scStatus, csUserAgent, csUsername, csReferer
| summarize RequestCount = count(), Paths = make_set(csUriStem, 20), UserAgents = make_set(csUserAgent, 10), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by cIP, sComputerName
| where RequestCount > 3
| order by RequestCount desc

index=iis (cs_uri_stem="*/_layouts/*" OR cs_uri_stem="*/_api/*" OR cs_uri_stem="*/_vti_bin/*" OR cs_uri_stem="*ToolPane.aspx*")
| eval user=coalesce(cs_username,"-")
| where cs_method="POST" AND (sc_status=200 OR sc_status=302) AND (user="-" OR user="")
| stats count AS request_count, values(cs_uri_stem) AS paths, values(cs_User_Agent) AS user_agents, min(_time) AS first_seen, max(_time) AS last_seen BY c_ip, s_computername
| where request_count > 3
| sort - request_count

sequence by source.ip with maxspan=10m
  [ network where url.path : ("*/_layouts/*", "*/_api/*", "*/_vti_bin/*", "*ToolPane.aspx*") and http.request.method == "POST" and (user.name == null or user.name == "-") and http.response.status_code in (200, 302) ]
  [ process where host.os.type == "windows" and process.parent.name == "w3wp.exe" and process.name in ("cmd.exe", "powershell.exe", "csc.exe", "cscript.exe") ]

SELECT sourceip, destinationip, "URL", "HTTP Method" AS method, "Username" AS username, "HTTP Response Code" AS status, COUNT(*) AS request_count FROM events WHERE LOGSOURCETYPENAME(devicetype) ILIKE '%IIS%' AND ("URL" ILIKE '%/_layouts/%' OR "URL" ILIKE '%/_api/%' OR "URL" ILIKE '%/_vti_bin/%' OR "URL" ILIKE '%ToolPane.aspx%') AND "HTTP Method" = 'POST' AND ("Username" IS NULL OR "Username" = '-' OR "Username" = '') AND "HTTP Response Code" IN ('200','302') GROUP BY sourceip, destinationip, "URL", method, username, status HAVING COUNT(*) > 3 ORDER BY request_count DESC LAST 24 HOURS

_sourceCategory=*iis* ("/_layouts/" OR "/_api/" OR "/_vti_bin/" OR "ToolPane.aspx")
| parse regex "(?<cs_method>\S+)\s+(?<cs_uri_stem>\S+)\s+(?<cs_uri_query>\S+)" nodrop
| parse regex "\s(?<cs_username>\S+)\s(?<c_ip>\d+\.\d+\.\d+\.\d+)" nodrop
| parse regex "\s(?<sc_status>\d{3})\s" nodrop
| where cs_method = "POST" and (sc_status = "200" or sc_status = "302") and (cs_username = "-" or isEmpty(cs_username))
| count as request_count by c_ip, cs_uri_stem
| where request_count > 3
| sort by request_count desc

rule sharepoint_weak_auth_cve_2026_55040 {
  meta:
    author = "Argus Detection Platform"
    description = "Detects CVE-2026-55040 SharePoint weak-authentication exploitation via unauthenticated POSTs to sensitive endpoints"
    cve = "CVE-2026-55040"
    severity = "HIGH"
  events:
    $e.metadata.event_type = "NETWORK_HTTP"
    $e.network.http.method = "POST"
    (
      re.regex($e.target.url, `.*/_layouts/.*`) or
      re.regex($e.target.url, `.*/_api/.*`) or
      re.regex($e.target.url, `.*/_vti_bin/.*`) or
      re.regex($e.target.url, `.*ToolPane\.aspx.*`)
    )
    $e.network.http.response_code = 200 or $e.network.http.response_code = 302
    ($e.principal.user.userid = "-" or $e.principal.user.userid = "")
    $ip = $e.principal.ip
  match:
    $ip over 10m
  condition:
    #e > 3
}

#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/ ParentBaseFileName="w3wp.exe"
| in(field="ImageFileName", values=["*\\cmd.exe", "*\\powershell.exe", "*\\csc.exe", "*\\cscript.exe", "*\\wscript.exe"])
| groupBy([aid, ComputerName, ParentBaseFileName, ImageFileName, CommandLine], function=[count(aid, as=exec_count), min(@timestamp, as=first_seen), max(@timestamp, as=last_seen)])
| sort(exec_count, order=desc)