SharePoint CVE-2025-53770 ToolShell Exploitation Attempt
This rule detects exploitation attempts against SharePoint servers, specifically targeting CVE-2025-53770 (ToolShell). It has two parts: one for suspicious process creation (cmd.exe spawning powershell.exe from w3wp.exe) and another for malicious web request patterns in IIS logs (POST requests to /_layouts/15/ToolPane.aspx with specific query parameters and referrer).
Microsoft Sentinel (KQL)
