All Detections

SharePoint Webshell Creation via CVE-2025-53770

avatar
Aaron Mog@AaronMogS2S
updated Jul 20, 20254662

Detects the creation of `spinstall0.aspx`, a known indicator of successful post-exploitation of the SharePoint vulnerability CVE-2025-53770.

Sigma