Suspicious child process of SAP NetWeaver on Windows using command and script interpreters

Flags SAP NetWeaver web work/root processes spawning Windows command/script tools that may indicate server-side execution.

FreeUnreviewedSigmamediumv1

suspicious-child-process-of-sap-netweaver-on-windows-using-command-and-script-in-5b304bcb

title: Suspicious child process of SAP NetWeaver on Windows using command and script interpreters
id: 569f7e4b-ac57-4850-b208-e28f916015e6
status: experimental
description: This rule identifies Windows process creations where the parent or current directory path matches SAP NetWeaver web application work/root directories, and the spawned child process is a common command, scripting, or living-off-the-land binary (e.g., cmd.exe, PowerShell variants, mshta, certutil, regsvr32). Such activity can indicate exploitation or post-exploitation behavior involving server-side execution. The detection relies on process creation telemetry, including the parent image path, current directory, and the child process image.
author: Elastic (idea), Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-04-28
tags:
  - attack.execution
  - attack.initial-access
  - attack.t1190
  - attack.persistence
  - attack.t1059.003
  - cve.2025-31324
  - detection.emerging-threats
references:
  - https://reliaquest.com/blog/threat-spotlight-reliaquest-uncovers-vulnerability-behind-sap-netweaver-compromise/
  - https://onapsis.com/blog/active-exploitation-of-sap-vulnerability-cve-2025-31324/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2025/Exploits/CVE-2025-31324/proc_creation_win_sap_netweaver_susp_child_process.yml
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent_img:
    ParentImage|contains:
      - \j2ee\cluster\apps\sap.com\irj\servlet_jsp\irj\work
      - \j2ee\cluster\apps\sap.com\irj\servlet_jsp\irj\root
  selection_current_dict:
    CurrentDirectory|contains:
      - \j2ee\cluster\apps\sap.com\irj\servlet_jsp\irj\work
      - \j2ee\cluster\apps\sap.com\irj\servlet_jsp\irj\root
  selection_child:
    Image|endswith:
      - \cmd.exe
      - \powershell.exe
      - \powershell_ise.exe
      - \pwsh.exe
      - \wscript.exe
      - \cscript.exe
      - \regsvr32.exe
      - \rundll32.exe
      - \mshta.exe
      - \certutil.exe
      - \bitsadmin.exe
      - \python.exe
  condition: (selection_parent_img or selection_current_dict) and selection_child
falsepositives:
  - Legitimate administrative activities such as software updates
level: medium
license: DRL-1.1
related:
  - id: 5b304bcb-ac33-49d0-87af-fa1b3ca94333
    type: derived

What it detects

This rule identifies Windows process creations where the parent or current directory path matches SAP NetWeaver web application work/root directories, and the spawned child process is a common command, scripting, or living-off-the-land binary (e.g., cmd.exe, PowerShell variants, mshta, certutil, regsvr32). Such activity can indicate exploitation or post-exploitation behavior involving server-side execution. The detection relies on process creation telemetry, including the parent image path, current directory, and the child process image.

Known false positives

Legitimate administrative activities such as software updates

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.