Linux: Suspicious child processes spawned by SAP NetWeaver (web application directories)

Alerts when SAP NetWeaver work/root paths spawn common shells or utilities on Linux, indicating potential malicious command execution.

FreeReviewedSigma · Medium · v5

Product: linux
Category: process_creation
Author: Elastic (idea), Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2025-04-28
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Initial Access → Execution

Recon
Resource Dev
Initial Access
- T1190Exploit Public-Facing Application
Execution
- T1059.003Windows Command Shell
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags Linux process creation where SAP NetWeaver runs a command-line interpreter, scripting/runtime, or common network/file-transfer utilities from within specific SAP servlet JSP work/root directories. Such parent-child process relationships can indicate webshell activity or post-exploitation command execution occurring from application context. It relies on process telemetry including ParentImage, CurrentDirectory, and the executed Image path suffix (e.g., /bash, /python3, /curl, /wget, /nc, /nmap).

Reporting behind it

Related detections9 linkedT1059.003 — drag to rearrange

Malicious IIS Worker Spawning nslookup via WS_FTP Deserialization

Suspicious Reconnaissance Commands Spawned by Samsung MagicINFO Server

Suspicious SolarWinds Web Help Desk Java Process Spawning Command Shell (via process_creation)

MSSQL Server Process Spawning Command Shell via xp_cmdshell

Malicious Command Shell Spawned by Wing FTP Server Process

Suspicious MSSQL xp_cmdshell OS Command Execution via sqlservr.exe (via process_creation)

Windows Process Creation: CrushFTP spawning PowerShell, CMD, and scripting tool execution

Windows: Suspicious Command-Line Child Processes Spawned by SAP NetWeaver Paths

Linux File Events: Webshell-like JSP/Java/Class Creation in SAP NetWeaver Directories

Linux: Suspicious child processes spawned by SAP NetWeaver (web application directories)

Pivot detection · T1059.003 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

linux-suspicious-command-child-process-from-sap-netweaver-work-root-directories-69dea60b

title: "Linux: Suspicious child processes spawned by SAP NetWeaver (web application directories)"
id: 2f89e293-c277-4e83-b97c-06a33c61f4a3
status: experimental
description: This rule flags Linux process creation where SAP NetWeaver runs a command-line interpreter, scripting/runtime, or common network/file-transfer utilities from within specific SAP servlet JSP work/root directories. Such parent-child process relationships can indicate webshell activity or post-exploitation command execution occurring from application context. It relies on process telemetry including ParentImage, CurrentDirectory, and the executed Image path suffix (e.g., /bash, /python3, /curl, /wget, /nc, /nmap).
author: Elastic (idea), Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-04-28
tags:
  - attack.execution
  - attack.initial-access
  - attack.t1190
  - attack.persistence
  - attack.t1059.003
  - cve.2025-31324
  - detection.emerging-threats
references:
  - https://reliaquest.com/blog/threat-spotlight-reliaquest-uncovers-vulnerability-behind-sap-netweaver-compromise/
  - https://onapsis.com/blog/active-exploitation-of-sap-vulnerability-cve-2025-31324/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2025/Exploits/CVE-2025-31324/proc_creation_lnx_sap_netweaver_susp_child_process.yml
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent_img:
    ParentImage|contains:
      - /j2ee/cluster/apps/sap.com/irj/servlet_jsp/irj/work
      - /j2ee/cluster/apps/sap.com/irj/servlet_jsp/irj/root
  selection_current_dict:
    CurrentDirectory|contains:
      - /j2ee/cluster/apps/sap.com/irj/servlet_jsp/irj/work
      - /j2ee/cluster/apps/sap.com/irj/servlet_jsp/irj/root
  selection_child:
    Image|endswith:
      - /ash
      - /bash
      - /csh
      - /dash
      - /ksh
      - /sh
      - /tcsh
      - /zsh
      - /python
      - /python2
      - /python3
      - /perl
      - /ruby
      - /curl
      - /wget
      - /nc
      - /netcat
      - /ncat
      - /socat
      - /nmap
      - /telnet
      - /awk
      - /sed
  condition: (selection_parent_img or selection_current_dict) and selection_child
falsepositives:
  - Legitimate administrative activities such as software updates
level: medium
license: DRL-1.1
related:
  - id: 69dea60b-2deb-4c9e-a685-ad542f4367f9
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL