APT_EXPL_Sharepoint_CVE_2025_53770_ForensicArtefact_Jul25_1

rule APT_EXPL_Sharepoint_CVE_2025_53770_ForensicArtefact_Jul25_1 {
   meta:
      description = "Detects URIs accessed during the exploitation of SharePoint RCE vulnerability CVE-2025-53770"
      author = "Florian Roth"
      reference = "https://research.eye.security/sharepoint-under-siege/"
      date = "2025-07-20"
      modified = "2025-07-23"
      score = 75
      id = "06ad76ef-fc9c-5251-a7c0-cbbb66d79b0e"
   strings:
      $sa1 = /POST \/_layouts\/1[0-9]\/ToolPane\.aspx/ ascii wide nocase
      $sa2 = "DisplayMode=Edit&a=/ToolPane.aspx" ascii wide

      $sb1 = /GET \/_layouts\/1[0-9]\/spinstall/ ascii wide  // specific
      $sb2 = "/_layouts/SignOut.aspx 200" ascii wide nocase
   condition:
      (@sa2 - @sa1) < 700  // unknown how specific with the DisplayMode=Edit parameter
      or (@sb2 - @sb1) < 700  // specific combination
      or (@sb2 - @sa1) < 700  // most generic combination
}