SharePoint ToolShell Vulnerability Exploitation Chain

Duo Tech@duotech

•updated Oct 22, 2025•2•0•88

Detects multiple TTPs associated with the exploitation of SharePoint ToolShell vulnerabilities (e.g., CVE-2025-53770) by the threat actor Storm-2603. This includes the initial exploit attempt, webshell creation, defense evasion using a vulnerable driver, and C2 communication.