SharePoint CVE-2025-53770 Exploitation Attempt

Detects potential exploitation attempts of the SharePoint vulnerability CVE-2025-53770 by looking for POST requests to ToolPane.aspx with a specific referrer.

Microsoft Sentinel (KQL)