Linux File Events: SAP NetWeaver JSP/Java/Class Webshell File Creation

Alerts on Linux file creation of .jsp/.java/.class under SAP NetWeaver IRJ servlet paths that may indicate webshell deployment.

FreeUnreviewedSigmamediumv1

linux-file-events-sap-netweaver-jsp-java-class-webshell-file-creation-5b91409c

title: "Linux File Events: SAP NetWeaver JSP/Java/Class Webshell File Creation"
id: 440dd6ea-a79f-467f-a71e-545058efc473
status: experimental
description: This rule flags file creation on Linux when the target path is within specific SAP NetWeaver servlet_jsp directories associated with IRJ work/root locations and the filename ends with .jsp, .java, or .class. Attackers may use these server-side artifacts to establish webshells or other persistent capabilities after gaining access. It relies on Linux file event telemetry that records the TargetFilename for newly created or modified files.
references:
  - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-31324
  - https://reliaquest.com/blog/threat-spotlight-reliaquest-uncovers-vulnerability-behind-sap-netweaver-compromise/
  - https://onapsis.com/blog/active-exploitation-of-sap-vulnerability-cve-2025-31324/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2025/Exploits/CVE-2025-31324/file_event_lnx_sap_netweaver_webshell_creation.yml
author: Elastic (idea), Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-04-28
tags:
  - attack.execution
  - attack.initial-access
  - attack.t1190
  - attack.persistence
  - attack.t1059.003
  - cve.2025-31324
  - detection.emerging-threats
logsource:
  product: linux
  category: file_event
detection:
  selection_path:
    TargetFilename|contains:
      - /j2ee/cluster/apps/sap.com/irj/servlet_jsp/irj/work/
      - /j2ee/cluster/apps/sap.com/irj/servlet_jsp/irj/root/
  selection_ext:
    TargetFilename|endswith:
      - .jsp
      - .java
      - .class
  condition: all of selection_*
falsepositives:
  - Legitimate creation of jsc or java files in these locations
level: medium
license: DRL-1.1
related:
  - id: 5b91409c-cb18-4ab6-ac75-c5759f998409
    type: derived

What it detects

This rule flags file creation on Linux when the target path is within specific SAP NetWeaver servlet_jsp directories associated with IRJ work/root locations and the filename ends with .jsp, .java, or .class. Attackers may use these server-side artifacts to establish webshells or other persistent capabilities after gaining access. It relies on Linux file event telemetry that records the TargetFilename for newly created or modified files.

Known false positives

Legitimate creation of jsc or java files in these locations

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.