SharePoint CVE-2025-49706 Exploitation Attempt
This rule detects attempts to exploit CVE-2025-49706 in SharePoint by observing POST requests to a vulnerable aspx path, which could result in code execution or server compromise. Specifically, it looks for HTTP POST requests to URLs containing '/_layouts/1(5|6)/ToolPane.aspx' and 'DisplayMode=Edit' and 'a=/ToolPane.aspx', combined with a referrer URL ending in '/_layouts/1(5|6)/signout.aspx'. This combination of indicators suggests an attempt to leverage the vulnerability for unauthorized access or code execution.
YARA-L
