added references

Author: terrancedejesus

rules/network/execution_potential_rce_via_toolshell.toml

@@ -15,6 +15,12 @@ language = "kuery"
 license = "Elastic License v2"
 max_signals = 10
 name = "Potential VIEWSTATE RCE Attempt on SharePoint/IIS"
+reference = [
+    "https://research.eye.security/sharepoint-under-siege/",
+    "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53771",
+    "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53770",
+    "https://msrc.microsoft.com/blog/2025/07/customer-guidance-for-sharepoint-vulnerability-cve-2025-53770/"
+]
 risk_score = 73
 rule_id = "99c9af5a-67cf-11f0-b69e-f661ea17fbcd"
 setup = """

rules/network/initial_access_potential_toolshell_exploit_attempt.toml

@@ -19,6 +19,12 @@ language = "kuery"
 license = "Elastic License v2"
 max_signals = 10
 name = "Potential Toolshell Initial Exploit (CVE-2025-53770 & CVE-2025-53771)"
+reference = [
+    "https://research.eye.security/sharepoint-under-siege/",
+    "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53771",
+    "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53770",
+    "https://msrc.microsoft.com/blog/2025/07/customer-guidance-for-sharepoint-vulnerability-cve-2025-53770/"
+]
 risk_score = 47
 rule_id = "6e4f6446-67ca-11f0-a148-f661ea17fbcd"
 setup = """