Potential SharePoint ToolShell CVE-2025-53770 Exploitation Indicators

SigmaHQ Detections@sigmaHQ

•updated Jul 21, 2025•2•0•35

Detects potential exploitation of CVE-2025-53770, a zero-day vulnerability in SharePoint that allows remote code execution. The rule identifies indicators such as suspicious command lines discovered in post-exploitation activities, specifically looking for `w3wp.exe` as a parent process executing encoded commands or referencing `spinstall0.aspx` within SharePoint layout paths.