Suspicious Filewrites To Sharepoint Layouts

Google SecOps@GoogleSecOps

•updated Sep 29, 2025•0•0•0

Detects a command-line interpreter (cmd.exe or powershell.exe) writing a file to a SharePoint (\TEMPLATE\LAYOUTS) directory.