Actor / Malware Family
ToolShell
1 query tagged with this actor.
-
Analytics Rules
Detect Sharepoint Toolshell Rce Encoded Command
SharePoint ToolShell RCE: encoded PowerShell arriving via SharePoint worker processes. Multi-token needles (`certutil -decode`) need `contains`, not `has_any`.