Successful SharePoint Webshell Creation CVE-2025-53770

Google SecOps@GoogleSecOps

•updated Sep 29, 2025•0•54

Detects the creation of a file named 'spinstall0.aspx' within specific SharePoint LAYOUTS directories. This activity is a strong indicator of successful post-exploitation of the SharePoint Server vulnerability CVE-2025-53770, where an attacker has likely placed a web shell for persistent access.