Sigma rule: Suspicious Child Process of SAP NetWeaver

Rule

Title

Suspicious Child Process of SAP NetWeaver

Status

experimental

Level

medium

Author

Elastic (idea), Swachchhanda Shrawan Poudel (Nextron Systems)

Date

2025-04-28

File

rules-emerging-threats/2025/Exploits/CVE-2025-31324/proc_creation_win_sap_netweaver_susp_child_process.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects suspicious child processes spawned by SAP NetWeaver that could indicate potential
exploitation of vulnerability that allows arbitrary execution via webshells such as CVE-2025-31324.

Log source

product

windows

category

process_creation

Detection

selection_parent_img:
    ParentImage|contains:
        - '\j2ee\cluster\apps\sap.com\irj\servlet_jsp\irj\work'
        - '\j2ee\cluster\apps\sap.com\irj\servlet_jsp\irj\root'
selection_current_dict:
    CurrentDirectory|contains:
        - '\j2ee\cluster\apps\sap.com\irj\servlet_jsp\irj\work'
        - '\j2ee\cluster\apps\sap.com\irj\servlet_jsp\irj\root'
selection_child:
    Image|endswith:
        - '\cmd.exe'
        - '\powershell.exe'
        - '\powershell_ise.exe'
        - '\pwsh.exe'
        - '\wscript.exe'
        - '\cscript.exe'
        - '\regsvr32.exe'
        - '\rundll32.exe'
        - '\mshta.exe'
        - '\certutil.exe'
        - '\bitsadmin.exe'
        - '\python.exe'
condition: (selection_parent_img or selection_current_dict) and selection_child

False positives (as the rule lists them)

• Legitimate administrative activities such as software updates

Tags

• attack.execution
• attack.initial-access
• attack.t1190
• attack.persistence
• attack.t1059.003
• cve.2025-31324
• detection.emerging-threats

CVEs this rule names

• CVE-2025-31324

MITRE ATT&CK ids this rule names

• T1059.003
• T1190

References

• https://reliaquest.com/blog/threat-spotlight-reliaquest-uncovers-vulnerability-behind-sap-netweaver-compromise/
• https://onapsis.com/blog/active-exploitation-of-sap-vulnerability-cve-2025-31324/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-emerging-threats/2025/Exploits/CVE-2025-31324/proc_creation_win_sap_netweaver_susp_child_process.yml