Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
11 detections
Filters
Last updated
All Time
Detection languages
4
4
3
Contributors
4
4
3
Categories
8
6
4
2
2
Platforms
10
4
1
Products / Services
5
4
4
3
2
MITRE Techniques
7
6
6
4
3
CVEs
68
68
63
58
50
IDS Classtypes
4
IDS Protocols
4
Detects exploitation attempts against Microsoft SharePoint leveraging the ToolShell exploit chain, as well as subsequent post-exploitation webshell activity involving anomalous 'layoutNsp.aspx' naming conventions. This covers initial exploitation of vulnerabilities such as CVE-2025-49704 and associated variants, followed by the deployment of webshells associated with the ToolShell campaign.
Detects exploitation attempts against Microsoft SharePoint leveraging the ToolShell exploit chain, as well as subsequent post-exploitation webshell activity involving anomalous 'layoutNsp.aspx' naming conventions. This covers initial exploitation of vulnerabilities such as CVE-2025-49704 and associated variants, followed by the deployment of webshells associated with the ToolShell campaign.
Detects exploitation attempts against Microsoft SharePoint leveraging the ToolShell exploit chain, as well as subsequent post-exploitation webshell activity involving anomalous 'layoutNsp.aspx' naming conventions. This covers initial exploitation of vulnerabilities such as CVE-2025-49704 and associated variants, followed by the deployment of webshells associated with the ToolShell campaign.
Detects exploitation attempts against Microsoft SharePoint leveraging the ToolShell exploit chain, as well as subsequent post-exploitation webshell activity involving anomalous 'layoutNsp.aspx' naming conventions. This covers initial exploitation of vulnerabilities such as CVE-2025-49704 and associated variants, followed by the deployment of webshells associated with the ToolShell campaign.
Detects the execution of an encoded PowerShell command where the parent process is w3wp.exe. This behavior is often indicative of an attacker leveraging a compromised web server (IIS) to execute malicious PowerShell scripts, potentially for further reconnaissance, privilege escalation, or payload delivery. The rule includes exclusions for known legitimate PowerShell scripts to reduce false positives.
This rule detects attempts to exploit CVE-2025-49706 in SharePoint by observing POST requests to a vulnerable aspx path, which could result in code execution or server compromise. Specifically, it looks for HTTP POST requests to URLs containing '/_layouts/1(5|6)/ToolPane.aspx' and 'DisplayMode=Edit' and 'a=/ToolPane.aspx', combined with a referrer URL ending in '/_layouts/1(5|6)/signout.aspx'. This combination of indicators suggests an attempt to leverage the vulnerability for unauthorized access or code execution.
This rule detects attempts to exploit CVE-2025-49706 in SharePoint by observing POST requests to a vulnerable aspx path, which could result in code execution or server compromise.
Detects on the execution of an encoded powershell command with a parent process of w3wp.exe.
Detects suspicious file writes to SharePoint layouts directory which could indicate webshell activity or post-exploitation. This behavior has been observed in the exploitation of SharePoint vulnerabilities such as CVE-2025-49704, CVE-2025-49706 or CVE-2025-53770.
Detects the creation of specific files (spinstall.aspx, spinstall?.aspx, debug_dev.js) within SharePoint's Web Server Extensions template layouts directory. This activity is indicative of successful exploitation of CVE-2025-53770, a zero-day vulnerability in SharePoint that allows remote code execution.
Detects suspicious file writes to SharePoint layouts directory which could indicate webshell activity or post-exploitation.
This behavior has been observed in the exploitation of SharePoint vulnerabilities such as CVE-2025-49704, CVE-2025-49706 or CVE-2025-53770.
This behavior has been observed in the exploitation of SharePoint vulnerabilities such as CVE-2025-49704, CVE-2025-49706 or CVE-2025-53770.