When Microsoft confirmed the SharePoint zero-day vulnerabilities exploited in the ToolShell campaign, it was already too late for many. Government agencies, universities, and critical infrastructure were compromised before emergency patches were released.

So, what should you do when a zero-day event like this happens?

Here’s the playbook we follow and recommend:

1.     Assume Exposure, Not Safety

Zero-days don’t come with a warning label. Even if a service is off by default, it may be enabled by third-party applications or legacy configurations. The first step is to assume exposure and immediately inventory all potentially affected systems. A centralized asset inventory helps you quickly identify where risk lives and how to contain it.

2.     Contain First, Investigate Second

Containment is about speed and decisiveness. Isolate vulnerable systems, disable compromised accounts, and block malicious domains or IPs. Don’t wait for a full forensic picture before acting. The longer you delay, the more time an attacker must pivot. Document every action in real time. This becomes critical for legal, insurance, and post-incident review.

3.     Patch Fast, But Don’t Stop There

“All it takes is one creative phish or nefarious website, and the system could become owned.” Patching is essential, but it’s not a silver bullet. In the SharePoint case, attackers had already stolen cryptographic keys, allowing them to re-enter even after patches were applied. Rebuild compromised systems, rotate credentials, and harden configurations to prevent re-exploitation.

4.     Communicate with Clarity

Clear, timely communication is often the difference between a controlled incident and a reputational crisis. Use pre-approved templates and escalation paths to notify internal stakeholders, clients, regulators, and law enforcement. If you don’t have these templates, build them now. Communication cadence should be predictable to reduce speculation and maintain trust.

5.     Document Everything

Assign a dedicated incident recorder to track every decision, action, and communication. This includes logs, timelines, and evidence for legal, compliance, and insurance purposes. Documentation also supports root cause analysis and helps refine your IR plan. If your IR team doesn’t have a shared playbook or centralized documentation, that’s a gap worth closing at once.

6.     Rehearse the Chaos

Tabletop exercises reveal gaps you won’t see on paper. These sessions help teams clarify roles, test escalation paths, and practice decision-making under pressure. After-action reviews should feed directly into updated playbooks, training, and tooling. A well-rehearsed team is your best defense when the unexpected hits.

Zero-days are chaos. Your response shouldn’t be.

#Cybersecurity #ZeroDay #IncidentResponse #SharePoint #Layer8Security #RiskManagement #ToolShell

BACK TO BLOGS