Sigma rule: Potential SAP NetWeaver Webshell Creation

Rule

Title

Potential SAP NetWeaver Webshell Creation

Status

experimental

Level

medium

Author

Elastic (idea), Swachchhanda Shrawan Poudel (Nextron Systems)

Date

2025-04-28

File

rules-emerging-threats/2025/Exploits/CVE-2025-31324/file_event_win_sap_netweaver_webshell_creation.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects the creation of suspicious files (jsp, java, class) in SAP NetWeaver directories,
which may indicate exploitation attempts of vulnerabilities such as CVE-2025-31324.

Log source

product

windows

category

file_event

Detection

selection_path:
    TargetFilename|contains:
        - '\j2ee\cluster\apps\sap.com\irj\servlet_jsp\irj\work'
        - '\j2ee\cluster\apps\sap.com\irj\servlet_jsp\irj\root'
selection_ext:
    TargetFilename|endswith:
        - '.jsp'
        - '.java'
        - '.class'
condition: all of selection_*

False positives (as the rule lists them)

• Legitimate creation of jsc or java files in these locations

Tags

• attack.execution
• attack.initial-access
• attack.t1190
• attack.persistence
• attack.t1059.003
• cve.2025-31324
• detection.emerging-threats

CVEs this rule names

• CVE-2025-31324

MITRE ATT&CK ids this rule names

• T1059.003
• T1190

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-31324
• https://reliaquest.com/blog/threat-spotlight-reliaquest-uncovers-vulnerability-behind-sap-netweaver-compromise/
• https://onapsis.com/blog/active-exploitation-of-sap-vulnerability-cve-2025-31324/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-emerging-threats/2025/Exploits/CVE-2025-31324/file_event_win_sap_netweaver_webshell_creation.yml