How to hunt and contain the latest SharePoint exploits

Multiple on‑premises Microsoft SharePoint Server vulnerabilities are being actively exploited in the wild, enabling code execution and theft of IIS/ASP.NET machine keys that can provide persistent access even after patches are applied. The report emphasizes that patching alone is insufficient for systems unpatched during the exploitation window and provides a seven‑step incident‑response playbook (scope exposure, contain without destroying evidence, hunt for artifacts, evict foothold, complete patch workflow, rotate machine keys, harden and monitor), plus observable artifacts and mitigations including application allowlisting, ringfencing, privileged access management, and network controls.