IOC SharePoint Exploitation Hashes Storm2603

R W@shiftyroot

•updated Jul 25, 2025•1•19

Detects malicious files (web shells, backdoors, and tools) associated with the exploitation of SharePoint vulnerabilities (e.g., CVE-2025-53770) by the threat actor Storm-2603. This rule matches known file hashes.