diff --git a/config/security_rules.json b/config/security_rules.json
index e19b2d60..f0827005 100644
--- a/config/security_rules.json
+++ b/config/security_rules.json
@@ -33964,6 +33964,23 @@
     ],
     "title": "Potential Exploitation of RCE Vulnerability CVE-2025-33053"
   },
+  {
+    "category": "process_creation",
+    "channel": [
+      "sec"
+    ],
+    "description": "Detects potential exploitation of CVE-2025-53770 by identifying indicators such as suspicious command lines discovered in Post-Exploitation activities.\nCVE-2025-53770 is a zero-day vulnerability in SharePoint that allows remote code execution.\n",
+    "event_ids": [
+      "4688"
+    ],
+    "id": "acecfe24-cf2a-2635-dded-a45c357eea3f",
+    "level": "high",
+    "service": "",
+    "subcategory_guids": [
+      "0CCE922B-69AE-11D9-BED3-505054503030"
+    ],
+    "title": "Potential SharePoint ToolShell CVE-2025-53770 Exploitation Indicators"
+  },
   {
     "category": "process_creation",
     "channel": [