Emerging Threatmediumexperimental

Potential SAP NetWeaver Webshell Creation - Linux

Detects the creation of suspicious files (jsp, java, class) in SAP NetWeaver directories, which may indicate exploitation attempts of vulnerabilities such as CVE-2025-31324.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Elastic Security, Swachchhanda Shrawan Poudel (Nextron Systems)Created Mon Apr 285b91409c-cb18-4ab6-ac75-c5759f9984092025

Emerging Threat

Active Threat

Developed to detect an active or emerging threat. Prioritize investigation of any alerts and correlate with threat intelligence.

Log Source

LinuxFile Event

ProductLinux← raw: linux

CategoryFile Event← raw: file_event

Events for file system activity including creation, modification, and deletion.

Detection Logic

detection:
    selection_path:
        TargetFilename|contains:
            - '/j2ee/cluster/apps/sap.com/irj/servlet_jsp/irj/work/'
            - '/j2ee/cluster/apps/sap.com/irj/servlet_jsp/irj/root/'
    selection_ext:
        TargetFilename|endswith:
            - '.jsp'
            - '.java'
            - '.class'
    condition: all of selection_*