ToolShell Malicious SharePoint Domains
This detection identifies network traffic to domains known to be used as command and control (C2) infrastructure in recent SharePoint exploitation campaigns. Communication with these domains is a strong indicator of compromise.
Splunk (SPL)
