Eric Gonzalez
@itsmemarioCompletionist
1 follower4 downloads3 copies2 likes45 views
1 detection
Filters
Last updated
All Time
Detection languages
1
Categories
1
1
1
Platforms
1
Products / Services
1
MITRE Techniques
1
1
1
1
1
This rule detects exploitation attempts against SharePoint servers, specifically targeting CVE-2025-53770 (ToolShell). It has two parts: one for suspicious process creation (cmd.exe spawning powershell.exe from w3wp.exe) and another for malicious web request patterns in IIS logs (POST requests to /_layouts/15/ToolPane.aspx with specific query parameters and referrer).
