What are the signs that a SharePoint deserialization exploit is already being attempted?

What the exploit trail looks like before full compromise

When a SharePoint deserialization exploit is already underway, the early signals usually come from a mix of application-layer tampering and host activity. Suspicious ASPX files, abnormal Referer values, and unexpected __VIEWSTATE manipulation are all consistent with an attacker probing the deserialization path and trying to move from a request-level foothold into code execution.

The most useful interpretation is correlation, not any single indicator in isolation. A malicious page drop, a burst of PowerShell, and log evidence of key retrieval attempts often appear together when the exploit chain is being assembled. That combination is materially stronger than routine noise because it suggests the attacker is testing trust boundaries, not just scanning the site.

One practical way to frame the pattern is that the web tier may be the first visible compromise point, while the real objective is usually payload execution and persistence. If you only watch for one artifact, you can miss the pivot from deserialization abuse into post-exploitation activity such as downloading a second stage or forcing an IIS restart to activate it.

Why these indicators matter operationally

These signs matter because SharePoint exploitation often moves quickly from malformed input to active code execution. Once the attacker can influence __VIEWSTATE handling or reach key material such as ValidationKey or DecryptionKey, the window for containment narrows sharply, and the defender is no longer dealing with a theoretical vulnerability but a likely in-progress intrusion.

That is why log review should focus on sequences, not isolated events. A payload fetch after key-related probing, or ASPX creation followed by PowerShell and service instability, is a strong exploitation narrative. In practice, that narrative is more actionable than any single IOC because it helps determine whether the system is merely exposed or already being used.

For teams that want a broader exploitation pattern reference, NHIMG’s 52 NHI Breaches Analysis is useful for understanding how quickly attackers turn initial access into broader compromise once a viable secret or execution path is found. For a more directly comparable exploitation example, Gladinet Hard-Coded Keys RCE Exploitation shows the same attacker logic of key abuse leading to remote code execution.

Risk and Threat Considerations

SharePoint deserialization activity is high-risk because the signals often appear at the boundary between reconnaissance and executable abuse. Once attackers can tamper with serialized state or reach key material, they may be able to turn a web request into code execution, which creates a short path from anomaly to full server compromise.

Failure mechanism: The attacker abuses deserialization handling, key discovery, or viewstate manipulation to bypass normal trust checks, then uses the resulting execution path to stage a payload, trigger IIS changes, or establish persistence.

Impact: Successful exploitation can expose the SharePoint server, connected content, and adjacent systems to command execution, credential theft, and rapid lateral movement, especially if the web application has broad access to internal resources.

Practitioner Guidance

What to verify: Treat ASPX creation, PowerShell launches, odd Referer strings, and __VIEWSTATE tampering as a correlated chain. Confirm whether the same host also shows outbound payload retrieval, unexpected IIS restarts, or attempts to enumerate or extract ValidationKey and DecryptionKey material.

Decision rule: If you see key-related probing plus any sign of payload activation, assume exploitation is active and move to containment before spending time proving the final payload intent. The evidence threshold should be lower than for many other web issues because the time from probe to compromise can be very short.

What to prioritise: Correlate SharePoint logs with endpoint telemetry and IIS events first, then isolate the host if the sequence suggests execution rather than benign scanning. If the same indicators recur across multiple servers, treat it as a campaign pattern, not a one-off anomaly.

Practitioner takeaway: The critical judgement is whether the telemetry shows a live exploitation chain, not just a suspicious request, so prioritise sequence correlation and containment as soon as key probing and payload activation appear together.

Related resources from NHI Mgmt Group

• How do security teams know if a framework exploit has already been attempted?
• What are the signs that post-exploit persistence is already in place?
• What are the signs that an Apache Struts upload exploit is being attempted?
• What should teams do when a runtime already blocks part of the exploit chain?