Webserver detections for SAP NetViewer JSP webshell command execution via cmd parameters

title: Webserver detections for SAP NetViewer JSP webshell command execution via cmd parameters
id: 3076c4f5-d1ea-4626-bb57-b0b21ad33a74
status: experimental
description: This rule flags HTTP requests to SAP NetViewer paths containing /irj/ and .jsp where the query string includes command-related parameters and payload patterns indicative of webshell command execution. It matters because attackers may use server-side script execution to run arbitrary system commands and establish persistence. The detection relies on webserver request telemetry, specifically the URI stem and query string contents.
references:
  - https://blog.eclecticiq.com/china-nexus-nation-state-actors-exploit-sap-netweaver-cve-2025-31324-to-target-critical-infrastructures
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2025/Exploits/CVE-2025-31324/web_lnx_exploit_cve_2025_31324_sap_netviewer_webshell.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-05-14
tags:
  - attack.persistence
  - attack.t1505.003
  - attack.initial-access
  - attack.t1190
  - detection.emerging-threats
  - cve.2025-31324
logsource:
  category: webserver
detection:
  selection_uri:
    cs-uri-stem|contains|all:
      - /irj/
      - .jsp
  selection_query:
    - cs-uri-query|startswith:
        - cmd=
        - command=
        - exec_cmd=
        - exec=
    - cs-uri-query|contains:
        - /dev/tcp
        - /etc/passwd
        - "%2fdev%2ftcp"
        - "%2fetc%2fpasswd"
        - =uname
        - =whoami
        - ifconfig
        - ping
        - pwd
    - cs-uri-query|contains|all:
        - echo
        - base64
  condition: all of selection_*
falsepositives:
  - Legitimate applications using cmd parameter for non-malicious purposes
level: high
license: DRL-1.1
related:
  - id: 94e12f41-6cb3-45c5-97b1-c783a7bf2e72
    type: derived