SharePoint ToolShell spinstall0.aspx and machine key harvesting (CVE-2025-53770)

ills3c Intel&Coffee@Ills3C

•updated 7 days ago•1•0•6

Detects indicators of ToolShell web shell creation (spinstall0.aspx) and ASP.NET machine key harvesting activities (reading web.config or accessing validationkey/decryptionkey materials via w3wp child processes or file access audits) on SharePoint servers.