Sigma rule: Potential SAP NetViewer Webshell Command Execution

Rule

Title

Potential SAP NetViewer Webshell Command Execution

Status

experimental

Level

high

Author

Swachchhanda Shrawan Poudel (Nextron Systems)

Date

2025-05-14

File

rules-emerging-threats/2025/Exploits/CVE-2025-31324/web_lnx_exploit_cve_2025_31324_sap_netviewer_webshell.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects potential command execution via webshell in SAP NetViewer through JSP files with cmd parameter.
This rule is created to detect exploitation of vulnerabilities like CVE-2025-31324, which allows remote code execution via a webshell.

Log source

category

webserver

Detection

selection_uri:
    cs-uri-stem|contains|all:
        - '/irj/'
        - '.jsp'
selection_query:
    - cs-uri-query|startswith:
          - 'cmd='
          - 'command='
          - 'exec_cmd='
          - 'exec='
    - cs-uri-query|contains:
          - '/dev/tcp'
          - '/etc/passwd'
          - '%2fdev%2ftcp' # URL encoded of /dev/tcp
          - '%2fetc%2fpasswd' # URL encoded of /etc/passwd
          - '=uname'
          - '=whoami'
          - 'ifconfig'
          - 'ping'
          - 'pwd'
    - cs-uri-query|contains|all:
          - 'echo'
          - 'base64'
condition: all of selection_*

False positives (as the rule lists them)

• Legitimate applications using cmd parameter for non-malicious purposes

Tags

• attack.persistence
• attack.t1505.003
• attack.initial-access
• attack.t1190
• detection.emerging-threats
• cve.2025-31324

CVEs this rule names

• CVE-2025-31324

MITRE ATT&CK ids this rule names

• T1190
• T1505.003

References

• https://blog.eclecticiq.com/china-nexus-nation-state-actors-exploit-sap-netweaver-cve-2025-31324-to-target-critical-infrastructures

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-emerging-threats/2025/Exploits/CVE-2025-31324/web_lnx_exploit_cve_2025_31324_sap_netviewer_webshell.yml