Emerging Threats
CVE2025

CVE-2025-53770

3Rules
4References
1Folders
2025-07-24Latest
Summary

CVE-2025-53770 is tracked here through 3 Sigma detections for exploitation attempts and related post-exploitation behavior observed in 2025. Coverage centers on webserver, windows / file_event, windows / process_creation.

Related Detections
Search this threat
Emerging Threatcriticalexperimental

Potential SharePoint ToolShell CVE-2025-53770 Exploitation - File Create

Detects the creation of file such as spinstall0.aspx which may indicate successful exploitation of CVE-2025-53770. CVE-2025-53770 is a zero-day vulnerability in SharePoint that allows remote code execution.

WindowsFile Event
TA0001 · Initial AccessT1190 · Exploit Public-Facing Applicationcve.2025-53770detection.emerging-threats
Swachchhanda Shrawan Poudel (Nextron Systems)Mon Jul 212025
Emerging Threathighexperimental

Potential SharePoint ToolShell CVE-2025-53770 Exploitation Indicators

Detects potential exploitation of CVE-2025-53770 by identifying indicators such as suspicious command lines discovered in Post-Exploitation activities. CVE-2025-53770 is a zero-day vulnerability in SharePoint that allows remote code execution.

WindowsProcess Creation
TA0001 · Initial AccessT1190 · Exploit Public-Facing Applicationcve.2025-53770detection.emerging-threats
Swachchhanda Shrawan Poudel (Nextron Systems)Mon Jul 212025
Emerging Threatmediumexperimental

SharePoint ToolShell CVE-2025-53770 Exploitation - Web IIS

Detects access to vulnerable SharePoint components potentially being exploited in CVE-2025-53770 through IIS web server logs. CVE-2025-53770 is a zero-day vulnerability in SharePoint that allows remote code execution.

Web Server Log
TA0001 · Initial AccessT1190 · Exploit Public-Facing Applicationcve.2025-53770detection.emerging-threats
Swachchhanda Shrawan Poudel (Nextron Systems)Mon Jul 212025
References