Webshell Drop in SharePoint Web-Accessible Directories (CVE-2026-45659 post-exploitation persistence)
This rule detects the creation of potentially malicious web-accessible files (e.g., .aspx, .ashx, .asmx) within sensitive SharePoint directory paths by the w3wp.exe process. This behavior is indicative of a webshell upload, which is a common persistence mechanism used by adversaries after gaining access to a web server.
Microsoft Sentinel (KQL)
