During SharePoint ToolShell Exploitation, threat actors used Mimikatz to dump LSASS memory.6
campaign
SharePoint ToolShell Exploitation C0058
- First seen
- July 2025
- Last seen
- July 2025
- Created
- 15 October 2025
- Last modified
- 31 July 2026
The SharePoint ToolShell Exploitation campaign was conducted in July 2025 and encompassed the first waves of exploitation against incompletely patched spoofing (CVE-2025-49706) and remote code execution (CVE-2025-49704) vulnerabilities affecting on-premises Microsoft SharePoint servers. Later patched and updated as CVE-2025-53770 and CVE-2025-53771, the ToolShell vulnerabilities were widely exploited including by China-based ransomware actor Storm-2603 and espionage actors Threat Group-3390 and ZIRCONIUM. SharePoint ToolShell Exploitation targeted multiple regions and industries including finance, education, energy, and healthcare across Asia, Europe, and the United States.[1][2][3][4][5]
35
TechniquesTop 7%
15
TacticsTop 1%
4
Tools & malware71st pct
0
Threat groupsNone recorded
Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.
MITRE reference C0058
During SharePoint ToolShell Exploitation, threat actors extracted information from the compromised systems.78910
During SharePoint ToolShell Exploitation, threat actors UPX-packed malicous payloads including 4L4MD4R ransomware.11
During SharePoint ToolShell Exploitation, threat actors executed Base64-encoded PowerShell commands.1213141516
During SharePoint ToolShell Exploitation, threat actors executed whoami on victim machines to enumerate user context and validate privilege levels.1718
During SharePoint ToolShell Exploitation, threat actors exfiltrated stolen credentials and internal data over HTTPS to C2 infrastructure.19
Standing C0058
Reach is how much of ATT&CK this campaign touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 56 ATT&CK campaigns only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.
Reach
Techniques35Top 7%
93rd percentile · 93% of 56 ATT&CK campaigns have this many Enterprise techniques or fewer.
Tactics15Top 1%
100th percentile · None of the 56 ATT&CK campaigns has more tactics spanned — the highest in the population.
Tools & malware471st pct
71st percentile · 71% of 56 ATT&CK campaigns have this many tools and malware or fewer.
Threat groups055% tie · 3 values
55% of the population shares a single value across only 3 distinct values, so a percentile here would rank the tie, not the entity.
Coverage
Rules / technique29medTop 14%
86th percentile · 86% of 56 ATT&CK campaigns have this many detection rules per technique or fewer.
Tests / technique4
Detection coverage C0058
1809 distinct rules cover the 35 techniques recorded for this campaign. The 2023 technique-to-rule mappings resolve to 1809 distinct rules, because one rule can cover several techniques. 1212 Sigma · 597 Splunk.
32 covered by at least one rule3 with no coverage1809 distinct rules in total
tf
Loading...Drag headers to reorder | Drag edges to resize
tf
Loading detections...
| Select | Title | Description | Category | Status | Event | Product | MITRE ATT&CK | CVEs | Severity | Author | Created | Updated | ID | Refs |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
© 2026 The MITRE Corporation. ATT&CK® and D3FEND™ data reproduced with permission. SigmaHQ detection rules licensed under DRL 1.1. attack.mitre.org · d3fend.mitre.org · CAR analytics licensed under Apache 2.0 · car.mitre.org