Suspicious SharePoint Activity

R W@shiftyroot

•updated Jul 23, 2025•1•2•60

This rule detects the execution of common command and scripting interpreters (cmd.exe, cscript.exe, powershell.exe, pwsh.exe, powershell_ise.exe, wmic.exe, wscript.exe) when their parent process is either w3wp.exe or svchost.exe, and the command arguments contain keywords related to SharePoint. This behavior can indicate suspicious activity within a SharePoint environment, potentially related to web shell execution, privilege escalation, or data exfiltration.