CVE-2026-56164 Elastic Security · Elastic

Detect Microsoft SharePoint Server Missing Authentication for Critical Function (CVE-2026-56164) in Elastic Security

Detects exploitation attempts against CVE-2026-56164, a Missing Authentication for Critical Function vulnerability (CWE-306) in Microsoft SharePoint Server that allows unauthenticated attackers to invoke sensitive server-side functionality without prior credentials. This flaw is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, indicating confirmed in-the-wild exploitation. Attackers typically abuse this by sending crafted HTTP requests directly to internal SharePoint API/service endpoints that fail to enforce authentication checks, potentially leading to remote code execution, data exfiltration, or the deployment of webshells (consistent with prior SharePoint ToolShell-style campaigns). This detection focuses on identifying anonymous or unauthenticated access to sensitive SharePoint endpoints, unusual IIS worker process child processes, and webshell-drop indicators following unauthenticated requests.

MITRE ATT&CK

Tactic
Initial Access Execution Privilege Escalation

Elastic Detection Query

Elastic Security (Elastic)
eql 
sequence by process.parent.name with maxspan=10m
  [network where event.category == "network" and destination.port in (443, 80) and url.path : ("*_layouts/15/*", "*_vti_bin/*", "*_api/*", "*ToolPane.aspx*") and not user.name : "*"]
  [process where event.category == "process" and process.parent.name : "w3wp.exe" and process.name : ("cmd.exe", "powershell.exe", "cscript.exe", "wscript.exe")]
critical severity medium confidence

Correlates unauthenticated requests to sensitive SharePoint endpoints followed by suspicious child process spawning from the IIS worker process (w3wp.exe), indicating potential post-exploitation activity from CVE-2026-56164.

Data Sources

Network traffic logsEndpoint process logs (Elastic Agent/Sysmon)

Required Tables

logs-network*logs-endpoint.events.process*

False Positives & Tuning

  • Legitimate SharePoint administrative scripts invoked via scheduled tasks under w3wp.exe
  • Anonymous read-only access to public SharePoint sites followed by unrelated process activity
  • Security tooling that legitimately spawns scripting engines from IIS app pools

Other platforms for CVE-2026-56164

Microsoft Sentinel (KQL) Splunk (SPL) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Unauthenticated Request to Sensitive SharePoint Endpoint

    Expected signal: IIS W3C log entry showing GET request to /_layouts/15/ToolPane.aspx with cs-username as '-' (anonymous).

  2. Test 2Simulated Webshell Drop via IIS Worker Process

    Expected signal: Sysmon Event ID 1 (process creation) showing cmd.exe spawned with parent w3wp.exe.

  3. Test 3Bulk Anonymous Requests to SharePoint API Endpoints

    Expected signal: Multiple IIS log entries within a short window for /_api/web/lists from the same source IP with anonymous username field.

Last updated: 2026-07-16 Research depth: standard
References (4)

Response Playbook

Triage

  1. Confirm SharePoint Server version/build against Microsoft's patched builds for CVE-2026-56164 to determine if the environment is vulnerable and whether the alert reflects a live exploitation attempt.
  2. Review IIS/W3C logs for the alerting source IP to identify all URI stems accessed, HTTP methods used, and response codes, focusing on anonymous requests to _layouts/15/, _vti_bin/, _api/, and ToolPane.aspx.
  3. Check for newly created or modified .aspx files, webshells, or unexpected files in SharePoint web application directories (e.g., LAYOUTS, wwwroot) created around the time of the suspicious requests.
  4. Inspect w3wp.exe process tree on the SharePoint server for unexpected child processes (cmd.exe, powershell.exe, cscript.exe) spawned after the unauthenticated request window.

Containment

  1. Block the offending source IP(s) at the perimeter firewall/WAF and, if internet-facing, temporarily restrict external access to the SharePoint endpoints until patched.
  2. Isolate the affected SharePoint server from the network (or disable the vulnerable service/endpoint) if active exploitation or webshell deployment is confirmed, pending remediation.

Evidence Collection

  1. Preserve IIS W3C logs, ULS (Unified Logging Service) logs, and SharePoint diagnostic logs covering the incident window for forensic review.
  2. Capture memory and disk images of the affected SharePoint server, and collect any suspicious .aspx/.dll files identified as potential webshells for malware analysis.

Escalation Criteria

  • !Escalate to incident response if a webshell, unauthorized administrative account, or evidence of lateral movement from the SharePoint server is confirmed.
  • !Escalate if the SharePoint server hosts sensitive/regulated data or serves as an identity/authentication trust boundary (e.g., integrated with AD FS or Entra ID), given the KEV status and potential for downstream compromise.

Investigation Guide

Related Techniques

[object Object][object Object][object Object]

Forensic Artifacts

  • >IIS W3C extended logs and SharePoint ULS logs showing anonymous requests to sensitive endpoints
  • >Newly created .aspx/.dll files under SharePoint LAYOUTS or web application directories
  • >w3wp.exe process creation events and child process telemetry (Sysmon Event ID 1)

Tuning Guidance

Baseline legitimate anonymous-access SharePoint sites and known health-check/monitoring source IPs, and add them to an allowlist to reduce false positives. Adjust the request-count threshold (currently 3 within 5 minutes) based on observed normal traffic volume for internet-facing SharePoint farms. Correlate IIS-based detections with endpoint telemetry (w3wp.exe child processes) to increase confidence before escalating, since URL-pattern matching alone can trigger on legitimate administrative or crawler traffic.

Hunting Queries

Broad retrospective hunt across all IIS logs for any unauthenticated access to sensitive SharePoint endpoints over an extended lookback window, to identify low-and-slow reconnaissance or exploitation attempts that may have preceded active alerting.

Hunting — KQL
kql 
W3CIISLog
| where csUriStem has_any ("_layouts/15/", "_vti_bin/", "_api/", "ToolPane.aspx")
| where isempty(csUsername) or csUsername == "-"
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Count=count() by cIP, csUriStem
| order by Count desc
Hunting — SPL
spl 
index=iis sourcetype=ms:iis:w3clogs (cs_uri_stem="*_layouts/15/*" OR cs_uri_stem="*_vti_bin/*" OR cs_uri_stem="*_api/*" OR cs_uri_stem="*ToolPane.aspx*") (cs_username="-" OR cs_username=null)
| stats earliest(_time) as first_seen latest(_time) as last_seen count by c_ip, cs_uri_stem
| sort -count

Atomic Red Team Tests

Test 1 Unauthenticated Request to Sensitive SharePoint Endpoint
windows

Simulates an unauthenticated HTTP GET request to a sensitive SharePoint administrative path to validate detection of anonymous access attempts, in a lab environment only.

Command

powershell 
Invoke-WebRequest -Uri "http://<lab-sharepoint-server>/_layouts/15/ToolPane.aspx?DisplayMode=Edit" -Headers @{} -UseBasicParsing

Cleanup

powershell 
No persistent changes made; clear IIS log test entries if isolating results: Remove-Item -Path 'C:\inetpub\logs\LogFiles\W3SVC1\*.log' -Confirm:$false (lab only).

Expected Telemetry

IIS W3C log entry showing GET request to /_layouts/15/ToolPane.aspx with cs-username as '-' (anonymous).

Expected Detection

KQL/SPL detections should flag the anonymous request to the sensitive ToolPane.aspx endpoint.

Test 2 Simulated Webshell Drop via IIS Worker Process
windows

Simulates a suspicious child process (cmd.exe) being spawned from a mock w3wp.exe context to validate detection of post-exploitation process activity following unauthenticated access, in a lab/test environment.

Command

powershell 
Start-Process -FilePath "cmd.exe" -ArgumentList "/c whoami" -PassThru | Out-Null # run in a test process renamed/impersonating w3wp.exe context in lab

Cleanup

powershell 
Terminate any lingering test processes: Get-Process cmd -ErrorAction SilentlyContinue | Stop-Process -Force.

Expected Telemetry

Sysmon Event ID 1 (process creation) showing cmd.exe spawned with parent w3wp.exe.

Expected Detection

Elastic EQL and CrowdStrike CQL rules should flag cmd.exe/powershell.exe spawned from w3wp.exe.

Test 3 Bulk Anonymous Requests to SharePoint API Endpoints
linux

Generates repeated unauthenticated requests to SharePoint REST API paths to validate detection of burst/threshold-based unauthenticated access patterns.

Command

bash 
for i in $(seq 1 5); do curl -s -o /dev/null -w '%{http_code}\n' http://<lab-sharepoint-server>/_api/web/lists; done

Cleanup

bash 
No persistent artifacts created on the attacking host; verify lab SharePoint server logs are rotated/cleared if used for repeated testing.

Expected Telemetry

Multiple IIS log entries within a short window for /_api/web/lists from the same source IP with anonymous username field.

Expected Detection

SPL and QRadar AQL threshold detections (>=3 requests in 5 minutes) should trigger on the burst pattern.

Related Detections

Tactic Hubs

TA0001Initial AccessTA0002ExecutionTA0004Privilege Escalation

Related Techniques

T1190Exploit Public-Facing ApplicationT1505.003Web ShellT1078Valid Accounts

Same Tactic: Initial Access

Popular Detections