Linux: Suspicious Command Child Process from SAP NetWeaver Work/Root Directories

Alerts when SAP NetWeaver work/root paths spawn common shells or utilities on Linux, indicating potential malicious command execution.

FreeUnreviewedSigmamediumv1

linux-suspicious-command-child-process-from-sap-netweaver-work-root-directories-69dea60b

title: "Linux: Suspicious Command Child Process from SAP NetWeaver Work/Root Directories"
id: 2f89e293-c277-4e83-b97c-06a33c61f4a3
status: experimental
description: This rule flags process creation on Linux where the parent or current working directory contains SAP NetWeaver servlet/JSP work or root paths and the spawned child process matches common command interpreter, scripting, and network utility binaries. Such execution chains can indicate compromise activity, including webshell-style abuse or follow-on command execution from within the application context. The detection relies on Linux process creation telemetry with accurate ParentImage, CurrentDirectory, and Image fields.
author: Elastic (idea), Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-04-28
tags:
  - attack.execution
  - attack.initial-access
  - attack.t1190
  - attack.persistence
  - attack.t1059.003
  - cve.2025-31324
  - detection.emerging-threats
references:
  - https://reliaquest.com/blog/threat-spotlight-reliaquest-uncovers-vulnerability-behind-sap-netweaver-compromise/
  - https://onapsis.com/blog/active-exploitation-of-sap-vulnerability-cve-2025-31324/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2025/Exploits/CVE-2025-31324/proc_creation_lnx_sap_netweaver_susp_child_process.yml
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent_img:
    ParentImage|contains:
      - /j2ee/cluster/apps/sap.com/irj/servlet_jsp/irj/work
      - /j2ee/cluster/apps/sap.com/irj/servlet_jsp/irj/root
  selection_current_dict:
    CurrentDirectory|contains:
      - /j2ee/cluster/apps/sap.com/irj/servlet_jsp/irj/work
      - /j2ee/cluster/apps/sap.com/irj/servlet_jsp/irj/root
  selection_child:
    Image|endswith:
      - /ash
      - /bash
      - /csh
      - /dash
      - /ksh
      - /sh
      - /tcsh
      - /zsh
      - /python
      - /python2
      - /python3
      - /perl
      - /ruby
      - /curl
      - /wget
      - /nc
      - /netcat
      - /ncat
      - /socat
      - /nmap
      - /telnet
      - /awk
      - /sed
  condition: (selection_parent_img or selection_current_dict) and selection_child
falsepositives:
  - Legitimate administrative activities such as software updates
level: medium
license: DRL-1.1
related:
  - id: 69dea60b-2deb-4c9e-a685-ad542f4367f9
    type: derived

What it detects

This rule flags process creation on Linux where the parent or current working directory contains SAP NetWeaver servlet/JSP work or root paths and the spawned child process matches common command interpreter, scripting, and network utility binaries. Such execution chains can indicate compromise activity, including webshell-style abuse or follow-on command execution from within the application context. The detection relies on Linux process creation telemetry with accurate ParentImage, CurrentDirectory, and Image fields.

Known false positives

Legitimate administrative activities such as software updates

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.