Detection rules › Sigma
Suspicious Child Process of SAP NetWeaver
Detects suspicious child processes spawned by SAP NetWeaver that could indicate potential exploitation of vulnerability that allows arbitrary execution via webshells such as CVE-2025-31324.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Initial Access | T1190 Exploit Public-Facing Application |
| Execution | T1059.003 Command and Scripting Interpreter: Windows Command Shell |
Event coverage
| Provider | Event | Title |
|---|---|---|
| Sysmon | Event ID 1 | Process creation |
Rule body yaml
title: Suspicious Child Process of SAP NetWeaver
id: 5b304bcb-ac33-49d0-87af-fa1b3ca94333
status: experimental
description: |
Detects suspicious child processes spawned by SAP NetWeaver that could indicate potential
exploitation of vulnerability that allows arbitrary execution via webshells such as CVE-2025-31324.
author: Elastic (idea), Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2025-04-28
tags:
- attack.execution
- attack.initial-access
- attack.t1190
- attack.persistence
- attack.t1059.003
- cve.2025-31324
- detection.emerging-threats
references:
- https://reliaquest.com/blog/threat-spotlight-reliaquest-uncovers-vulnerability-behind-sap-netweaver-compromise/
- https://onapsis.com/blog/active-exploitation-of-sap-vulnerability-cve-2025-31324/
logsource:
category: process_creation
product: windows
detection:
selection_parent_img:
ParentImage|contains:
- '\j2ee\cluster\apps\sap.com\irj\servlet_jsp\irj\work'
- '\j2ee\cluster\apps\sap.com\irj\servlet_jsp\irj\root'
selection_current_dict:
CurrentDirectory|contains:
- '\j2ee\cluster\apps\sap.com\irj\servlet_jsp\irj\work'
- '\j2ee\cluster\apps\sap.com\irj\servlet_jsp\irj\root'
selection_child:
Image|endswith:
- '\cmd.exe'
- '\powershell.exe'
- '\powershell_ise.exe'
- '\pwsh.exe'
- '\wscript.exe'
- '\cscript.exe'
- '\regsvr32.exe'
- '\rundll32.exe'
- '\mshta.exe'
- '\certutil.exe'
- '\bitsadmin.exe'
- '\python.exe'
condition: (selection_parent_img or selection_current_dict) and selection_child
falsepositives:
- Legitimate administrative activities such as software updates
level: medium
Stages and Predicates
Stage 0: condition
(selection_parent_img or selection_current_dict) and selection_childStage 1: selection_parent_img
selection_parent_img:
ParentImage|contains:
- '\j2ee\cluster\apps\sap.com\irj\servlet_jsp\irj\work'
- '\j2ee\cluster\apps\sap.com\irj\servlet_jsp\irj\root'
Stage 2: selection_current_dict
selection_current_dict:
CurrentDirectory|contains:
- '\j2ee\cluster\apps\sap.com\irj\servlet_jsp\irj\work'
- '\j2ee\cluster\apps\sap.com\irj\servlet_jsp\irj\root'
Stage 3: selection_child
selection_child:
Image|endswith:
- '\cmd.exe'
- '\powershell.exe'
- '\powershell_ise.exe'
- '\pwsh.exe'
- '\wscript.exe'
- '\cscript.exe'
- '\regsvr32.exe'
- '\rundll32.exe'
- '\mshta.exe'
- '\certutil.exe'
- '\bitsadmin.exe'
- '\python.exe'
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
CurrentDirectory | match |
|
Image | ends_with |
|
ParentImage | match |
|