Suspicious File Writes to SharePoint Layouts Directory

Google SecOps@GoogleSecOps

•updated Sep 29, 2025•1•0•60

Detects when a command-line interpreter (cmd.exe or powershell.exe) writes or modifies a file within a SharePoint \TEMPLATE\LAYOUTS directory. This activity is suspicious as it could indicate an attempt to deploy a web shell or other malicious code to gain persistent access or execute commands on the SharePoint server. The rule specifically excludes a known legitimate SharePoint automation script to reduce false positives.