SharePoint Unauthenticated ToolPane.aspx POST
This rule detects HTTP POST requests to specific SharePoint application paths, including ToolPane.aspx and SignOut.aspx. These paths have historically been associated with SharePoint vulnerabilities, particularly unauthenticated remote code execution (RCE) exploits. The rule aims to identify attempts to interact with these sensitive endpoints, which could indicate an attacker attempting to exploit known vulnerabilities or perform unauthorized actions.
Sigma
