Sigma rule: Suspicious Child Process of SAP NetWeaver - Linux

Rule

Title

Suspicious Child Process of SAP NetWeaver - Linux

Status

experimental

Level

medium

Author

Elastic (idea), Swachchhanda Shrawan Poudel (Nextron Systems)

Date

2025-04-28

File

rules-emerging-threats/2025/Exploits/CVE-2025-31324/proc_creation_lnx_sap_netweaver_susp_child_process.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects suspicious child processes spawned by SAP NetWeaver on Linux systems that could indicate potential
exploitation of vulnerability that allows arbitrary execution via webshells such as CVE-2025-31324.

Log source

product

linux

category

process_creation

Detection

selection_parent_img:
    ParentImage|contains:
        - '/j2ee/cluster/apps/sap.com/irj/servlet_jsp/irj/work'
        - '/j2ee/cluster/apps/sap.com/irj/servlet_jsp/irj/root'
selection_current_dict:
    CurrentDirectory|contains:
        - '/j2ee/cluster/apps/sap.com/irj/servlet_jsp/irj/work'
        - '/j2ee/cluster/apps/sap.com/irj/servlet_jsp/irj/root'
selection_child:
    Image|endswith:
        - '/ash'
        - '/bash'
        - '/csh'
        - '/dash'
        - '/ksh'
        - '/sh'
        - '/tcsh'
        - '/zsh'
        - '/python'
        - '/python2'
        - '/python3'
        - '/perl'
        - '/ruby'
        - '/curl'
        - '/wget'
        - '/nc'
        - '/netcat'
        - '/ncat'
        - '/socat'
        - '/nmap'
        - '/telnet'
        - '/awk'
        - '/sed'
condition: (selection_parent_img or selection_current_dict) and selection_child

False positives (as the rule lists them)

• Legitimate administrative activities such as software updates

Tags

• attack.execution
• attack.initial-access
• attack.t1190
• attack.persistence
• attack.t1059.003
• cve.2025-31324
• detection.emerging-threats

CVEs this rule names

• CVE-2025-31324

MITRE ATT&CK ids this rule names

• T1059.003
• T1190

References

• https://reliaquest.com/blog/threat-spotlight-reliaquest-uncovers-vulnerability-behind-sap-netweaver-compromise/
• https://onapsis.com/blog/active-exploitation-of-sap-vulnerability-cve-2025-31324/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-emerging-threats/2025/Exploits/CVE-2025-31324/proc_creation_lnx_sap_netweaver_susp_child_process.yml