Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
553 detections
Filters
Last updated
All Time
Detection languages
243
124
45
35
32
Contributors
124
91
63
58
25
Categories
233
201
170
131
113
Platforms
364
242
56
8
7
Products / Services
255
130
110
98
60
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
CVEs
15
14
14
9
8
IDS Classtypes
30
5
IDS Protocols
35
This detection identifies known malicious file hashes associated with SharePoint exploitation campaigns. These hashes correspond to web shells and post-exploitation tools observed in attacks by threat actors like Storm-2603.
Detects malicious files (web shells, backdoors, and tools) associated with the exploitation of SharePoint vulnerabilities (e.g., CVE-2025-53770) by the threat actor Storm-2603. This rule matches known file hashes.
Active exploitation of CVE-2025-53770 involves the creation of this file, indicating successful post-exploitation.
CVE-2025-53770 Exploitation hunt
The following analytic detects potential post-exploitation activity related to the Microsoft SharePoint CVE-2025-53770 vulnerability. After successful exploitation via the ToolPane.aspx endpoint, attackers typically deploy a webshell named "spinstall0.aspx" in the SharePoint layouts directory. This detection identifies GET requests to this webshell, which indicates active use of the backdoor for command execution, data exfiltration, or credential/key extraction. Attackers commonly use these webshells to extract encryption keys, authentication tokens, and other sensitive information from the compromised SharePoint server.
The analytic detects potential exploitation attempts against Microsoft SharePoint Server vulnerability CVE-2025-53770, also known as "ToolShell". This detection monitors for POST requests to the ToolPane.aspx endpoint with specific DisplayMode parameter, which is a key indicator of the exploit. This vulnerability allows unauthenticated remote code execution on affected SharePoint servers, enabling attackers to fully access SharePoint content, file systems, internal configurations, and execute code over the network.
Detects the creation of "spinstall0.aspx", a file dropped after the successful exploitation of the SharePoint vulnerability CVE-2025-53770. This file is a known webshell.
This detection identifies the creation or modification of the "spinstall0.aspx" webshell file in Microsoft SharePoint directories. This file is a known indicator of compromise associated with the exploitation of CVE-2025-53770 (ToolShell vulnerability). Attackers exploit the vulnerability to drop webshells that provide persistent access to compromised SharePoint servers, allowing them to execute arbitrary commands, access sensitive data, and move laterally within the network.
SPL Query
Detects suspicious file writes to SharePoint layouts directory which could indicate webshell activity or post-exploitation.
This behavior has been observed in the exploitation of SharePoint vulnerabilities such as CVE-2025-49704, CVE-2025-49706 or CVE-2025-53770.
This behavior has been observed in the exploitation of SharePoint vulnerabilities such as CVE-2025-49704, CVE-2025-49706 or CVE-2025-53770.
This rule detects the execution of common command-line utilities (wget, curl, nc, bash, python, perl, php, sh) within web server directories. This activity is highly suspicious as it could indicate an attacker attempting to download malicious files, execute web shells, or perform other post-exploitation activities on a compromised web server.
KQL Query
Detects suspicious IIS native-code module installations via command line
'This hunting query looks in Azure Web Application Firewall data to find possible SpringShell Exploitation Attempt (CVE-2022-22965).
The Spring Framework is one of the most widely used lightweight open-source framework for Java. To exploit the vulnerability attackers can
send a specially crafted query to a web server running the Spring Core framework to change the target of logging facility and create a new
malicious JSP file in a location accessible by http requests. Attackers then make requests to the malicious backdoor to run system commands.
Reference: https://www.microsoft.com/security/blog/2022/04/04/springshell-rce-vulnerability-guidance-for-protecting-against-and-detecting-cve-2022-22965/'
The Spring Framework is one of the most widely used lightweight open-source framework for Java. To exploit the vulnerability attackers can
send a specially crafted query to a web server running the Spring Core framework to change the target of logging facility and create a new
malicious JSP file in a location accessible by http requests. Attackers then make requests to the malicious backdoor to run system commands.
Reference: https://www.microsoft.com/security/blog/2022/04/04/springshell-rce-vulnerability-guidance-for-protecting-against-and-detecting-cve-2022-22965/'
Detects patterns found in process executions cause by China Chopper like tiny (ASPX) webshells
Detects certain parent child patterns found in cases in which a web shell is used to perform certain credential dumping or exfiltration activities on a compromised system
Rule to detect an adversary setting OabVirtualDirectory External URL property to a script in Exchange Management log
Detects certain parent child patterns found in cases in which a web shell is used to perform certain credential dumping or exfiltration activities on a compromised system
Detects certain command line parameters often used during reconnaissance activity via web shells
Detects a program executing from a web server root folder. Use this rule to hunt for potential interesting activity such as webshell or backdoors
Detects the creation of files with certain extensions on a static web site. This can be indicative of potential uploads of a web shell.
Page 23 of 27