SharePoint Upload.aspx Path Traversal Attempt
Detects attempts to exploit a path traversal vulnerability in SharePoint's Upload.aspx page by looking for requests to 'Upload.aspx' that include both 'List=' and 'RootFolder=' parameters, specifically targeting sensitive catalogs like '_catalogs'. This indicates an attempt to upload files to unauthorized locations.
Microsoft Sentinel (KQL)
