[Guest Diary] Hunting for SharePoint In-Memory ToolShell Payloads, (Tue, Dec 2nd)

This guest-hunting diary documents detection and analysis of the ToolShell SharePoint exploit chain (CVE-2025-53770/53771). It demonstrates using Zeek logs and PCAP analysis (DaemonLogger, mergecap, Wireshark) to identify malicious POST requests to ToolPane.aspx, extract and decode the CompressedDataTable payload, and reveal in-memory .NET DLLs (e.g., osvmhdfl.dll, jlaneafi.dll) and encoded PowerShell used for reconnaissance and exfiltration, plus scanner payloads and relevant IoCs.