SharePoint ToolShell CVE-2025-53770 Exploitation - Web IIS

SigmaHQ Detections@sigmaHQ

•updated Jul 21, 2025•0•42

Detects access to vulnerable SharePoint components potentially being exploited in CVE-2025-53770 through IIS web server logs. CVE-2025-53770 is a zero-day vulnerability in SharePoint that allows remote code execution.