Successful SharePoint Webshell Creation CVE-2025-53770

Google SecOps@GoogleSecOps

•updated Sep 29, 2025•0•0•1

Detects the creation of a file containing 'spinstall0' in specific SharePoint LAYOUTS directories. This activity is a strong indicator of successful post-exploitation of the SharePoint Server vulnerability CVE-2025-53770, where an attacker has likely placed a web shell for persistent access.