CVE-2025-53770 - SharePoint ToolShell

// CVE-2025-53770 - WebShell Discovery from w3wp.exe

correlate(
    cmd: {
        #event_simpleName=ProcessRollup2 event_platform=Win FileName="cmd.exe" ParentBaseFileName="w3wp.exe"
          } include: [aid, ComputerName, TargetProcessId, ParentBaseFileName, FileName, CommandLine],
    pwsh: {
        #event_simpleName=ProcessRollup2 event_platform=Win FileName="powershell.exe"
          | aid <=> cmd.aid
          | ParentProcessId <=> cmd.TargetProcessId
          } include: [aid, ComputerName, TargetProcessId, ParentBaseFileName, FileName, CommandLine],
    aspx: {
        #event_simpleName=/^(NewScriptWritten|WebScriptFileWritten)$/ event_platform=Win FileName=/\.aspx/i
          | aid <=> cmd.aid
          | ContextProcessId <=> pwsh.TargetProcessId
          } include: [aid, ComputerName, TargetFileName],
sequence=true, within=5m)