Rapid7 has a blog post on how Sharepoint was compromised: https://www.rapid7.com/blog/post/20...harepoint-compromise-ir-tales-from-the-field/ Interestingly, they installed a legit AV to crash existing security software:
