Windows: Suspicious Command-Line Child Processes Spawned by SAP NetWeaver Paths

Flags SAP NetWeaver web work/root processes spawning Windows command/script tools that may indicate server-side execution.

FreeReviewedSigma · Medium · v5

Product: windows
Category: process_creation
Author: Elastic (idea), Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2025-04-28
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Initial Access → Execution

Recon
Resource Dev
Initial Access
- T1190Exploit Public-Facing Application
Execution
- T1059.003Windows Command Shell
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies Windows process creation events where SAP NetWeaver-related working/root directories spawn common scripting and proxy execution binaries (cmd.exe, PowerShell, pwsh, wscript/cscript, regsvr32, rundll32, mshta, certutil, bitsadmin, python). Such child process activity can indicate webshell-driven or post-compromise execution attempts within SAP application directories. It relies on process creation telemetry with parent image and current directory path matches, plus the child process image name ending with known execution utilities.

Reporting behind it

Related detections9 linkedT1059.003 — drag to rearrange

Malicious IIS Worker Spawning nslookup via WS_FTP Deserialization

Suspicious Reconnaissance Commands Spawned by Samsung MagicINFO Server

Suspicious SolarWinds Web Help Desk Java Process Spawning Command Shell (via process_creation)

MSSQL Server Process Spawning Command Shell via xp_cmdshell

Malicious Command Shell Spawned by Wing FTP Server Process

Suspicious MSSQL xp_cmdshell OS Command Execution via sqlservr.exe (via process_creation)

Windows Process Creation: CrushFTP spawning PowerShell, CMD, and scripting tool execution

Linux File Events: Webshell-like JSP/Java/Class Creation in SAP NetWeaver Directories

Linux: Suspicious child processes spawned by SAP NetWeaver (web application directories)

Windows: Suspicious Command-Line Child Processes Spawned by SAP NetWeaver Paths

Pivot detection · T1059.003 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

suspicious-child-process-of-sap-netweaver-on-windows-using-command-and-script-in-5b304bcb

title: "Windows: Suspicious Command-Line Child Processes Spawned by SAP NetWeaver Paths"
id: 569f7e4b-ac57-4850-b208-e28f916015e6
status: experimental
description: This rule identifies Windows process creation events where SAP NetWeaver-related working/root directories spawn common scripting and proxy execution binaries (cmd.exe, PowerShell, pwsh, wscript/cscript, regsvr32, rundll32, mshta, certutil, bitsadmin, python). Such child process activity can indicate webshell-driven or post-compromise execution attempts within SAP application directories. It relies on process creation telemetry with parent image and current directory path matches, plus the child process image name ending with known execution utilities.
author: Elastic (idea), Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-04-28
tags:
  - attack.execution
  - attack.initial-access
  - attack.t1190
  - attack.persistence
  - attack.t1059.003
  - cve.2025-31324
  - detection.emerging-threats
references:
  - https://reliaquest.com/blog/threat-spotlight-reliaquest-uncovers-vulnerability-behind-sap-netweaver-compromise/
  - https://onapsis.com/blog/active-exploitation-of-sap-vulnerability-cve-2025-31324/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2025/Exploits/CVE-2025-31324/proc_creation_win_sap_netweaver_susp_child_process.yml
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent_img:
    ParentImage|contains:
      - \j2ee\cluster\apps\sap.com\irj\servlet_jsp\irj\work
      - \j2ee\cluster\apps\sap.com\irj\servlet_jsp\irj\root
  selection_current_dict:
    CurrentDirectory|contains:
      - \j2ee\cluster\apps\sap.com\irj\servlet_jsp\irj\work
      - \j2ee\cluster\apps\sap.com\irj\servlet_jsp\irj\root
  selection_child:
    Image|endswith:
      - \cmd.exe
      - \powershell.exe
      - \powershell_ise.exe
      - \pwsh.exe
      - \wscript.exe
      - \cscript.exe
      - \regsvr32.exe
      - \rundll32.exe
      - \mshta.exe
      - \certutil.exe
      - \bitsadmin.exe
      - \python.exe
  condition: (selection_parent_img or selection_current_dict) and selection_child
falsepositives:
  - Legitimate administrative activities such as software updates
level: medium
license: DRL-1.1
related:
  - id: 5b304bcb-ac33-49d0-87af-fa1b3ca94333
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL