SharePoint CVE-2025-53770 Post-Exploitation File Creation

Yolanda Icepa@yicepa

•updated Jul 21, 2025•1•0•36

Detects the creation of "spinstall0.aspx", a file dropped after the successful exploitation of the SharePoint vulnerability CVE-2025-53770. This file is a known webshell.