SharePoint Reconnaissance Attempt for CVE-2025-53770

nomit vyas@xoxo

•updated Aug 8, 2025•4•0•73

Detects reconnaissance activity associated with the exploitation of SharePoint vulnerabilities (CVE-2025-53770, CVE-2025-53771, etc.). Attackers send a specific HTTP POST request to ToolPane.aspx to probe for vulnerable servers.