alert http $EXTERNAL_NET any -> $HOME_NET any (msg: "ET EXPLOIT SharePoint RCE ToolShell CVE-2025-53770"; http.method; content: "POST"; flow: established, to_server; http.uri; pcre:"/\/_layouts\/\d+\/[^?]+\.aspx\?DisplayMode=Edit&a=\/[^?]+\.aspx/"; http.accept_enc; content:"gzip, deflate"; http.referer; content: "/_layouts/SignOut.aspx"; http.request_body; content: "MSOTlPn_DWP"; content:"_controltemplates"; content: "AclEditor.ascx"; content: "CompressedDataTable"; content: "Scorecard"; content: "ExcelDataSet"; reference: url,https://research.eye.security/sharepoint-under-siege/; reference: url,https://github.com/kaizensecurity/CVE-2025-53770/tree/master; reference: url, https://www.rapid7.com/blog/post/etr-zero-day-exploitation-of-microsoft-sharepoint-servers-cve-2025-53770/; classtype:web-application-attack; sid:1000000; rev: 1;)

alert http $EXTERNAL_NET any -> $HOME_NET any (msg: "ET EXPLOIT SharePoint RCE ToolShell CVE-2025-53770"; http.method; content: "GET"; flow: established, to_server; http.uri; pcre:"/\/_layouts\/\d+\/[^?]+\.aspx/"; http.referer; content: "/_layouts/SignOut.aspx"; reference: url,https://research.eye.security/sharepoint-under-siege/; reference: url,https://github.com/kaizensecurity/CVE-2025-53770/tree/master; reference: url, https://www.rapid7.com/blog/post/etr-zero-day-exploitation-of-microsoft-sharepoint-servers-cve-2025-53770/; classtype:web-application-attack; sid:1000001; rev: 1;)