SharePoint ToolShell Exploitation
Campaign · ATTACK:enterprise:C0058
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:C0058",
"title": "SharePoint ToolShell Exploitation",
"type": "Campaign",
"source_url": "https://attack.mitre.org/campaigns/C0058",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "campaign--1a0576df-df21-4775-843e-844d8a58a94b",
"external_id": "C0058",
"domain": "enterprise",
"created": "2025-10-15T19:31:55.608Z",
"modified": "2026-07-31T18:47:16.890Z",
"version": "1.0",
"aliases": [
"SharePoint ToolShell Exploitation"
],
"tactics": [
],
"source_references": [
{
"source_name": "Trend Micro SharePoint Attacks JUL 2025",
"url": "https://www.trendmicro.com/en_us/research/25/g/cve-2025-53770-and-cve-2025-53771-sharepoint-attacks.html"
},
{
"source_name": "ESET ToolShell JUL 2025",
"url": "https://www.welivesecurity.com/en/eset-research/toolshell-an-all-you-can-eat-buffet-for-threat-actors/"
},
{
"source_name": "Eye Research ToolShell JUL 2025",
"url": "https://research.eye.security/sharepoint-under-siege/"
},
{
"source_name": "Microsoft SharePoint Exploit JUL 2025",
"url": "https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/#storm-2603"
},
{
"source_name": "Palo Alto SharePoint Vulnerabilities JUL 2025",
"url": "https://unit42.paloaltonetworks.com/microsoft-sharepoint-cve-2025-49704-cve-2025-49706-cve-2025-53770/"
}
]
}Explicit source assertions (39)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:C0058 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--11875739-9167-4e09-8a97-0e5b19d5e795
Microsoft SharePoint Exploit JUL 2025ATTACK:enterprise:C0058 → uses → ATTACK:enterprise:S0029
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1195fdb7-59c3-4426-ba2d-ac86d079ddf9
Microsoft SharePoint Exploit JUL 2025ATTACK:enterprise:C0058 → uses → ATTACK:enterprise:T1033
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--12e8b4b1-e6b4-4ced-b171-e9e2fb881e7b
SentinelOne ToolShell JUL 2025 · Microsoft SharePoint Exploit JUL 2025ATTACK:enterprise:C0058 → uses → ATTACK:enterprise:T1552.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1448897c-4b9a-44ef-a0ce-371f98c1f2f3
Trend Micro SharePoint Attacks JUL 2025 · Eye Research ToolShell JUL 2025 · SentinelOne ToolShell JUL 2025 · Microsoft SharePoint Exploit JUL 2025 · Palo Alto SharePoint Vulnerabilities JUL 2025ATTACK:enterprise:C0058 → uses → ATTACK:enterprise:T1027.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--33b2a8e7-658a-4c00-bd88-bcc36c980012
Palo Alto SharePoint Vulnerabilities JUL 2025ATTACK:enterprise:C0058 → uses → ATTACK:enterprise:T1071.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--33e169b7-d597-43d7-a333-f5e20afad49d
Trend Micro SharePoint Attacks JUL 2025 · Eye Research ToolShell JUL 2025 · SentinelOne ToolShell JUL 2025 · Microsoft SharePoint Exploit JUL 2025 · Palo Alto SharePoint Vulnerabilities JUL 2025ATTACK:enterprise:C0058 → uses → ATTACK:enterprise:T1083
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--355c008f-e48a-45f1-8ab8-f04fff3b7915
Microsoft SharePoint Exploit JUL 2025ATTACK:enterprise:C0058 → uses → ATTACK:enterprise:T1505.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3c7dad36-c2dc-4a9d-b0fb-fee2414512b5
Trend Micro SharePoint Attacks JUL 2025 · ESET ToolShell JUL 2025 · Eye Research ToolShell JUL 2025 · SentinelOne ToolShell JUL 2025 · Microsoft SharePoint Exploit JUL 2025 · Palo Alto SharePoint Vulnerabilities JUL 2025ATTACK:enterprise:C0058 → uses → ATTACK:enterprise:T1583.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3eb4f68b-eaa3-4ea2-b340-c4fb9bbffe82
Microsoft SharePoint Exploit JUL 2025 · Palo Alto SharePoint Vulnerabilities JUL 2025ATTACK:enterprise:C0058 → uses → ATTACK:enterprise:T1140
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--49c8b6c8-9c61-45d1-b7d0-aa778f58f055
Palo Alto SharePoint Vulnerabilities JUL 2025ATTACK:enterprise:C0058 → uses → ATTACK:enterprise:T1484.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4c9c2fb2-8e06-4ad8-93e5-45d4e8b2494c
Microsoft SharePoint Exploit JUL 2025ATTACK:enterprise:C0058 → uses → ATTACK:enterprise:T1003.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6051e3e5-dd5c-4753-8e7d-66c2e18a044a
Microsoft SharePoint Exploit JUL 2025ATTACK:enterprise:C0058 → uses → ATTACK:enterprise:S0002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--66e4c037-f848-4af1-9138-b5bba80acf45
Microsoft SharePoint Exploit JUL 2025ATTACK:enterprise:C0058 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--68a9e6aa-c9c1-48b8-afb8-4f8eb68b0ea0
Eye Research ToolShell JUL 2025 · SentinelOne ToolShell JUL 2025 · Microsoft SharePoint Exploit JUL 2025 · Palo Alto SharePoint Vulnerabilities JUL 2025ATTACK:enterprise:C0058 → uses → ATTACK:enterprise:T1657
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6948916f-eba5-4f23-8630-22035d00b7c3
Palo Alto SharePoint Vulnerabilities JUL 2025ATTACK:enterprise:C0058 → uses → ATTACK:enterprise:T1190
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6cfdc8e4-4970-428b-80c3-89ebb12328c4
Trend Micro SharePoint Attacks JUL 2025 · ESET ToolShell JUL 2025 · Eye Research ToolShell JUL 2025 · SentinelOne ToolShell JUL 2025 · Microsoft SharePoint Exploit JUL 2025 · Palo Alto SharePoint Vulnerabilities JUL 2025ATTACK:enterprise:C0058 → uses → ATTACK:enterprise:T1047
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--812699e3-ffb0-4aec-b7d9-96680311d5a4
Microsoft SharePoint Exploit JUL 2025ATTACK:enterprise:C0058 → uses → ATTACK:enterprise:T1119
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--86c5119f-eea3-48c6-a89b-1c77bbb84246
Trend Micro SharePoint Attacks JUL 2025 · Palo Alto SharePoint Vulnerabilities JUL 2025ATTACK:enterprise:C0058 → uses → ATTACK:enterprise:S0508
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--899555f4-8eb6-4685-89b4-06358bbc4e73
Microsoft SharePoint Exploit JUL 2025ATTACK:enterprise:C0058 → uses → ATTACK:enterprise:T1572
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8c8ac729-e986-4503-a1c8-5696e78f4bdc
Microsoft SharePoint Exploit JUL 2025ATTACK:enterprise:C0058 → uses → ATTACK:enterprise:T1585.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8d4579a3-aa24-4bfa-b567-8116fdbc2569
Palo Alto SharePoint Vulnerabilities JUL 2025ATTACK:enterprise:C0058 → uses → ATTACK:enterprise:T1082
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--923f1f73-2a15-4653-b7b3-83a9be2d94ba
Microsoft SharePoint Exploit JUL 2025ATTACK:enterprise:C0058 → uses → ATTACK:enterprise:T1486
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--965ddb53-b695-4e13-9f3b-dba8c6509edb
Microsoft SharePoint Exploit JUL 2025 · Palo Alto SharePoint Vulnerabilities JUL 2025ATTACK:enterprise:C0058 → uses → ATTACK:enterprise:T1074.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9ff590a0-b722-4282-8644-ff7344ac54b2
Trend Micro SharePoint Attacks JUL 2025 · Palo Alto SharePoint Vulnerabilities JUL 2025ATTACK:enterprise:C0058 → uses → ATTACK:enterprise:T1505.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a49c8e4c-876a-4771-a1e5-f54aad2f0fcd
Microsoft SharePoint Exploit JUL 2025ATTACK:enterprise:C0058 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a7160173-63e0-434a-a5e5-8a8347f6f828
ESET ToolShell JUL 2025 · Eye Research ToolShell JUL 2025 · SentinelOne ToolShell JUL 2025 · Microsoft SharePoint Exploit JUL 2025ATTACK:enterprise:C0058 → uses → ATTACK:enterprise:T1027.010
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--af15ac73-56cc-4a16-bcf9-806c93c5f321
Trend Micro SharePoint Attacks JUL 2025 · Eye Research ToolShell JUL 2025 · SentinelOne ToolShell JUL 2025 · Microsoft SharePoint Exploit JUL 2025 · Palo Alto SharePoint Vulnerabilities JUL 2025ATTACK:enterprise:C0058 → uses → ATTACK:enterprise:T1090
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b7cba2d6-7f3e-4402-b195-a21b0cf5e5d2
ESET ToolShell JUL 2025 · Microsoft SharePoint Exploit JUL 2025ATTACK:enterprise:C0058 → uses → ATTACK:enterprise:T1685
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ba600b5b-e026-4ce9-8ce5-b48506b897df
Microsoft SharePoint Exploit JUL 2025 · Palo Alto SharePoint Vulnerabilities JUL 2025ATTACK:enterprise:C0058 → uses → ATTACK:enterprise:S0357
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c0956230-5ac8-49ce-9491-37d9171d926b
Microsoft SharePoint Exploit JUL 2025ATTACK:enterprise:C0058 → uses → ATTACK:enterprise:T1588.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d3bc0783-3912-40b4-a995-4241ef218977
Microsoft SharePoint Exploit JUL 2025ATTACK:enterprise:C0058 → uses → ATTACK:enterprise:T1569.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d5e069df-6933-417e-b62d-6c8701438382
Microsoft SharePoint Exploit JUL 2025ATTACK:enterprise:C0058 → uses → ATTACK:enterprise:T1112
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d6d05488-44f6-4018-9e40-d8b9c98b68b6
Microsoft SharePoint Exploit JUL 2025ATTACK:enterprise:C0058 → uses → ATTACK:enterprise:T1620
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e54aad60-0f67-4eef-b269-5c783dc98748
Trend Micro SharePoint Attacks JUL 2025 · Eye Research ToolShell JUL 2025 · SentinelOne ToolShell JUL 2025 · Microsoft SharePoint Exploit JUL 2025 · Palo Alto SharePoint Vulnerabilities JUL 2025ATTACK:enterprise:C0058 → uses → ATTACK:enterprise:T1595.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e86fefd2-7f69-4dfe-92e4-8c62421c8db6
Palo Alto SharePoint Vulnerabilities JUL 2025ATTACK:enterprise:C0058 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e9384783-49a9-4ef0-89e7-aa2f94f389df
Palo Alto SharePoint Vulnerabilities JUL 2025ATTACK:enterprise:C0058 → uses → ATTACK:enterprise:T1570
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f725411c-c69a-47c5-b399-2bae53b4b559
Microsoft SharePoint Exploit JUL 2025ATTACK:enterprise:C0058 → uses → ATTACK:enterprise:T1041
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fb35e052-245d-4da3-b43f-664e1595cca2
Microsoft SharePoint Exploit JUL 2025ATTACK:enterprise:C0058 → uses → ATTACK:enterprise:T1005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fcef9b21-8ad5-4c9d-bb04-a5db2053a223
ESET ToolShell JUL 2025 · SentinelOne ToolShell JUL 2025 · Microsoft SharePoint Exploit JUL 2025 · Palo Alto SharePoint Vulnerabilities JUL 2025