SharePoint Vulnerability Exploitation Attempt (CVE-2025-49704, CVE-2025-49706, CVE-2025-53770)

Frederico Canhoto@nullwhire

•updated Jul 21, 2025•7•5•60

This rule detects the creation of a suspicious file named 'spinstall0.aspx' or similar in a specific SharePoint template directory, which is indicative of a potential compromise related to CVE-2025-49704, CVE-2025-49706, or CVE-2025-53770. Additionally, it identifies network connections to known malicious IP addresses associated with these vulnerabilities.