ToolShell Malicious SharePoint Hashes

R W@shiftyroot

•updated Jul 24, 2025•2•0•39

This detection identifies known malicious file hashes associated with SharePoint exploitation campaigns. These hashes correspond to web shells and post-exploitation tools observed in attacks by threat actors like Storm-2603.