Linux File Events: Webshell-like JSP/Java/Class Creation in SAP NetWeaver Directories
Alerts on Linux file creation of .jsp/.java/.class under SAP NetWeaver IRJ servlet paths that may indicate webshell deployment.
- Product
- linux
- Category
- file_event
- Author
- Elastic (idea), Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2025-04-28
- Updated
- 2026-07-31
ATT&CK techniques
Initial Access → ExecutionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Linux file events where a file is created in specific SAP NetWeaver work directories and the filename extension ends with .jsp, .java, or .class. Creating or dropping these artifacts in the web application path can indicate webshell upload or other server-side code execution attempts. It relies on file_event telemetry that includes the target file path and supports substring and filename extension matching.
Reporting behind it
- cve.mitre.orghttps://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-31324
- reliaquest.comhttps://reliaquest.com/blog/threat-spotlight-reliaquest-uncovers-vulnerability-behind-sap-netweaver-compromise/
- onapsis.comhttps://onapsis.com/blog/active-exploitation-of-sap-vulnerability-cve-2025-31324/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2025/Exploits/CVE-2025-31324/file_event_lnx_sap_netweaver_webshell_creation.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Linux File Events: Webshell-like JSP/Java/Class Creation in SAP NetWeaver Directories"
id: 440dd6ea-a79f-467f-a71e-545058efc473
status: experimental
description: This rule flags Linux file events where a file is created in specific SAP NetWeaver work directories and the filename extension ends with .jsp, .java, or .class. Creating or dropping these artifacts in the web application path can indicate webshell upload or other server-side code execution attempts. It relies on file_event telemetry that includes the target file path and supports substring and filename extension matching.
references:
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-31324
- https://reliaquest.com/blog/threat-spotlight-reliaquest-uncovers-vulnerability-behind-sap-netweaver-compromise/
- https://onapsis.com/blog/active-exploitation-of-sap-vulnerability-cve-2025-31324/
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2025/Exploits/CVE-2025-31324/file_event_lnx_sap_netweaver_webshell_creation.yml
author: Elastic (idea), Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-04-28
tags:
- attack.execution
- attack.initial-access
- attack.t1190
- attack.persistence
- attack.t1059.003
- cve.2025-31324
- detection.emerging-threats
logsource:
product: linux
category: file_event
detection:
selection_path:
TargetFilename|contains:
- /j2ee/cluster/apps/sap.com/irj/servlet_jsp/irj/work/
- /j2ee/cluster/apps/sap.com/irj/servlet_jsp/irj/root/
selection_ext:
TargetFilename|endswith:
- .jsp
- .java
- .class
condition: all of selection_*
falsepositives:
- Legitimate creation of jsc or java files in these locations
level: medium
license: DRL-1.1
related:
- id: 5b91409c-cb18-4ab6-ac75-c5759f998409
type: derived