Potential SharePoint ToolShell CVE-2025-53770 Exploitation - File Create

SigmaHQ Detections@sigmaHQ

•updated Jul 28, 2025•0•34

Detects the creation of specific files (spinstall.aspx, spinstall?.aspx, debug_dev.js) within SharePoint's Web Server Extensions template layouts directory. This activity is indicative of successful exploitation of CVE-2025-53770, a zero-day vulnerability in SharePoint that allows remote code execution.