CVE-2026-56164 — Microsoft SharePoint Server Pre-Auth Zero-Day

CVE-2026-56164 is an actively-exploited zero-day in on-premises Microsoft SharePoint Server 2016, 2019, and Subscription Edition, patched in the July 2026 "Patch Tuesday" (the largest Microsoft release on record, 570–622 CVEs). Microsoft classifies it as "missing authentication for a critical function" allowing an unauthorized attacker to elevate privilege over the network. It requires no authentication and no user interaction (pre-auth, zero-click) and was discovered by Mandiant / Google FLARE incident responders during real-world intrusions — which is why its base CVSS of 5.3 badly understates operational risk. CISA added it to the KEV catalog on 2026-07-14 with a remediation due date of 2026-07-17.

Per CISA and Microsoft, post-exploitation establishes remote code execution and then performs classic on-prem SharePoint tradecraft: stealing IIS machine keys (the ASP.NET ValidationKey/DecryptionKey), performing deserialization to forge __VIEWSTATE payloads for durable, patch-surviving access, dropping ASPX web shells, and deploying follow-on malware. Because the stolen machine key lets an attacker regenerate valid signed ViewState at will, patching alone does not evict them — machine keys MUST be rotated.

The defensive value of this pack is that exploitation surfaces on the endpoint as a small set of high-fidelity behaviors even when the exploit payload itself is opaque: the IIS worker process (w3wp.exe) spawning a command interpreter, ASPX/ASHX files being written into the SharePoint LAYOUTS/web directories, and commands touching machine keys or web.config. These are the anchor hunts below.

Defender priority: Treat any internet-facing on-prem SharePoint as presumed-compromised until proven clean. Do three things today — (1) apply the July 2026 SharePoint updates, (2) rotate IIS/ASP.NET machine keys and restart IIS (patching without rotation leaves signed-ViewState persistence intact), and (3) enable AMSI Full Request Body scanning. Then hunt with Q1–Q6.

Intel gap (perishability): As of the pack date no vendor has published atomic IOCs (web-shell filenames, hashes, C2 IPs) specific to CVE-2026-56164. This pack is therefore behavior-anchored; the IOC appendix ships REPLACE_WITH_… placeholders to fill the moment your IR team or a vendor report yields campaign atomics. No atomic indicator here is fabricated.

Hunt hypotheses (fidelity-ordered)

Attack chain

This is a behavior-first pack. The atomic rows below are placeholders to be populated from your IR findings or a vendor report; the behavioral rows are the operative indicators today.

• IIS access logs: Review POSTs to SharePoint _layouts endpoints with anomalous, oversized, or Base64-heavy request bodies, and requests bearing a crafted Referer. Correlate suspicious client IPs against the same window as any Falcon hit.
• SharePoint ULS logs: Search for deserialization / ViewState MAC validation errors and unexpected application-pool identity actions.
• AMSI: After enabling AMSI Full Request Body scanning, monitor Defender/AMSI events on the SharePoint servers for blocked request bodies — a direct exploitation signal.
• web.config integrity: Baseline machineKey values; alert on any change to ValidationKey/DecryptionKey outside a planned rotation. An attacker-known key = live persistence.
• Filesystem sweep: Enumerate *.aspx/*.ashx under the SharePoint web root and LAYOUTS folders; diff against a known-good file list and creation timestamps.

Promote Q1 and Q4 to blocking IOAs after a short baseline; keep Q2/Q3/Q5/Q6 as investigate-only scheduled searches until tuned to your farm.

• Telemetry ready: Confirm Falcon sensors are installed and reporting on every on-prem SharePoint web front end (not just app/DB tiers).
• Benign baseline: Run Q2 and Q6 across a normal patch/maintenance window first to learn legitimate WSP-deploy and agent noise, then apply the TUNING exclusions before alerting.
• Positive test: In a lab, launch cmd.exe as the SharePoint app-pool identity from w3wp context and confirm Q1 fires; drop a benign .aspx into LAYOUTS and confirm Q2 fires.
• Promotion: Promote Q1/Q4 to blocking IOAs only after the baseline shows zero benign hits for a rolling week.

Rotate ASP.NET machine keys on a SharePoint farm (run after patching)

# Rotate the farm ViewState/machine keys via SharePoint management shell.
# Do this on ONE server; the farm propagates. Then IISRESET on each WFE.
Add-PSSnapin Microsoft.SharePoint.PowerShell -ErrorAction SilentlyContinue
Set-SPMachineKey -WebApplication (Get-SPWebApplication)   # rotate per web app
Update-SPMachineKey -WebApplication (Get-SPWebApplication) # push new key to farm
# On EACH web front end:
iisreset /noforce
# Verify old key no longer accepted: forged ViewState from the stolen key now fails MAC validation.

Enable AMSI Full Request Body scanning (interim mitigation)

# SharePoint Subscription / patched builds expose AMSI request-body scanning.
# Enable and set to Full Request Body mode, then recycle the app pools.
Set-SPManagedAccountAmsi -EnableAmsi $true    # where supported
# In Central Admin: Security -> Configure AMSI -> enable, mode = Full Request Body.
# Confirm Microsoft Defender / a compatible AV with AMSI is running on each WFE.
Restart-Service W3SVC

Enumerate suspect ASPX under the SharePoint web root

$roots = @(
  "C:\Program Files\Common Files\microsoft shared\Web Server Extensions\16\TEMPLATE\LAYOUTS",
  "C:\inetpub\wwwroot\wss\VirtualDirectories"
)
Get-ChildItem -Path $roots -Recurse -Include *.aspx,*.ashx,*.asmx -ErrorAction SilentlyContinue |
  Sort-Object LastWriteTime -Descending |
  Select-Object FullName, CreationTime, LastWriteTime, Length | Format-Table -Auto
# Investigate any file whose CreationTime is recent / outside a patch window.

Gaps: The exploit request itself is only visible in IIS/ULS logs (S7), and re-use of a stolen machine key produces valid-looking traffic that endpoint telemetry cannot distinguish — the only reliable control there is key rotation, not detection. Populate the atomic IOC placeholders (S10) once IR yields them to close the CVE-to-atomic gap.