(TLP:CLEAR) CISA Adds SharePoint Compromise Template to Its Eviction Strategies Tool

Summary: CISA has added a new template to its Eviction Strategies Tool that helps incident response teams respond to on-premises Microsoft SharePoint compromises. The Eviction Strategies Tool, which WaterISAC previously covered when CISA released it in July 2025, is a no-cost resource that helps cyber defenders build customized playbooks for containing and evicting adversaries from compromised systems and networks. It is made up of two components: Playbook-NG, a web application that matches incident findings to recommended response actions, and COUN7ER, a database of atomic post-compromise countermeasures mapped to adversary tactics, techniques, and procedures (TTPs).

The new SharePoint template provides a pre-built mapping of relevant ATT&CK techniques to ten countermeasures that incident response teams can review, customize, and apply during a SharePoint intrusion. As with all templates in the tool, defenders can use the set as is or expand on it with findings specific to their own environment, then export the resulting playbook in formats including JSON, Microsoft Word, Excel, and markdown.

Analyst Note: This template is timely given the widespread exploitation of on-premises SharePoint vulnerabilities over the past year, which affected organizations across critical infrastructure. For water and wastewater utilities that run SharePoint on-premises, having a ready-made containment and eviction starting point removes much of the delay in the early hours of a response, when speed matters most. The template is equally useful outside a live incident: utilities can load it into a tabletop exercise to practice their response before an intrusion occurs.

WaterISAC has been closely tracking this activity, most recently in its (TLP:AMBER+STRICT) Vulnerability Notification – Microsoft SharePoint Server Actively Exploited. The new template gives incident response teams a ready-made containment and eviction starting point for exactly this kind of intrusion.

As WaterISAC noted when the tool was first released, this remains a valuable free resource that network defenders can add to their arsenal, and its value grows as CISA scales back some of its other no-cost, hands-on offerings. WaterISAC encourages members to explore the new SharePoint template, incorporate it into response planning and exercises, and build eviction playbooks for the threats most relevant to their environment.

Original Source: https://www.cisa.gov/eviction-strategies-tool/review-playbook

Additional Reading:

• CISA: Eviction Strategies Tool
• WaterISAC: CISA Releases Free Eviction Strategies Tool to Complement Incident Response
• (TLP:AMBER+STRICT) Vulnerability Notification – Microsoft SharePoint Server Actively Exploited

Related WaterISAC PIRs: 6, 8, 10, 12