Microsoft SharePoint Server Missing Authentication for Critical Function (CVE-2026-56164)

let SuspiciousPaths = dynamic(["/_layouts/15/", "/_vti_bin/", "/_api/", "/_forms/default.aspx", "/ToolPane.aspx"]);
W3CIISLog
| where cIP !in ("127.0.0.1", "::1")
| where csUriStem has_any (SuspiciousPaths)
| where scStatus in (200, 302, 401, 403)
| where isempty(csUsername) or csUsername == "-"
| summarize RequestCount = count(), UriStems = make_set(csUriStem, 20), Methods = make_set(csMethod, 10) by cIP, bin(TimeGenerated, 5m)
| where RequestCount >= 3
| project TimeGenerated, cIP, RequestCount, UriStems, Methods
| order by TimeGenerated desc

index=iis sourcetype=ms:iis:w3clogs
| eval susp_path=if(match(cs_uri_stem, "(?i)(_layouts/15/|_vti_bin/|_api/|_forms/default\.aspx|ToolPane\.aspx)"), 1, 0)
| where susp_path=1
| where cs_username="-" OR isnull(cs_username)
| bin _time span=5m
| stats count as request_count values(cs_uri_stem) as uri_stems values(cs_method) as methods by c_ip, _time
| where request_count >= 3
| sort -_time

sequence by process.parent.name with maxspan=10m
  [network where event.category == "network" and destination.port in (443, 80) and url.path : ("*_layouts/15/*", "*_vti_bin/*", "*_api/*", "*ToolPane.aspx*") and not user.name : "*"]
  [process where event.category == "process" and process.parent.name : "w3wp.exe" and process.name : ("cmd.exe", "powershell.exe", "cscript.exe", "wscript.exe")]

SELECT sourceip, destinationip, URL, username, COUNT(*) as requestCount
FROM events
WHERE LOGSOURCETYPENAME(devicetype) = 'Microsoft IIS'
AND (URL ILIKE '%_layouts/15/%' OR URL ILIKE '%_vti_bin/%' OR URL ILIKE '%_api/%' OR URL ILIKE '%ToolPane.aspx%')
AND (username IS NULL OR username = '-')
GROUP BY sourceip, destinationip, URL, username
HAVING COUNT(*) >= 3
LAST 1 HOURS

_sourceCategory=iis/sharepoint
| where !isNull(cs_uri_stem)
| where cs_uri_stem matches "*_layouts/15/*" or cs_uri_stem matches "*_vti_bin/*" or cs_uri_stem matches "*_api/*" or cs_uri_stem matches "*ToolPane.aspx*"
| where cs_username = "-" or isNull(cs_username)
| timeslice 5m
| count by c_ip, _timeslice, cs_uri_stem
| where _count >= 3
| sort by _timeslice desc

rule cve_2026_56164_sharepoint_unauth_access {
  meta:
    description = "Detects unauthenticated access to sensitive SharePoint endpoints indicative of CVE-2026-56164 exploitation"
    severity = "CRITICAL"
    cve = "CVE-2026-56164"
  events:
    $e.metadata.event_type = "NETWORK_HTTP"
    $e.target.url = /.*(_layouts\/15\/|_vti_bin\/|_api\/|ToolPane\.aspx).*/ nocase
    $e.principal.user.userid = ""
  match:
    $e.principal.ip over 5m
  condition:
    $e and #e >= 3
}

#event_simpleName=ProcessRollup2
| ParentBaseFileName="w3wp.exe"
| in(field=FileName, values=["cmd.exe", "powershell.exe", "cscript.exe", "wscript.exe", "csc.exe"])
| join(query={#event_simpleName=NetworkConnectIP4 OR #event_simpleName=HttpRequestHeader}, field=aid, key=aid, mode=inner)
| groupBy([ComputerName, ParentBaseFileName, FileName], function=count(as=exec_count))
| exec_count >= 1