Attempted SharePoint Webshell Creation CVE-2025-53770

Google SecOps@GoogleSecOps

•updated Sep 29, 2025•1•0•4

Detects the attempted creation of a file containing 'spinstall0' in specific SharePoint LAYOUTS directories. This activity is a strong indicator of an attempt to exploit the SharePoint Server vulnerability CVE-2025-53770.