SAP NetViewer Webshell Command Execution via JSP cmd Parameter

Alerts on SAP NetViewer JSP requests likely used as webshells to execute system commands via cmd-style query parameters.

FreeReviewedSigma · High · v5

Category: webserver
Author: Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2025-05-14
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Initial Access → Persistence

Recon
Resource Dev
Initial Access
- T1190Exploit Public-Facing Application
Execution
Persistence
- T1505.003Web Shell
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags HTTP requests to SAP NetViewer paths containing /irj/ and .jsp where the query string includes command-execution parameters (such as cmd=, command=, exec_cmd=, or exec=). It further narrows matches to suspicious command strings and patterns commonly used to test or stage system command execution, including probes for /dev/tcp, /etc/passwd, and basic OS commands (e.g., uname, whoami, ifconfig, ping, pwd) as well as echo and base64 usage. It relies on web server request telemetry fields for the full URI stem and query string (cs-uri-stem and cs-uri-query) to identify these potentially malicious combinations.

Reporting behind it

Related detections9 linkedT1190 — drag to rearrange

Malicious Web Shell Written to SharePoint LAYOUTS Directory by Worker Process (via file_event)

Malicious Command Shell Spawned by SQL Server via Process Creation (via process_creation)

Possible GoAnywhere MFT Exploitation via Tomcat Spawning Discovery Commands

Suspicious Command Shell Spawned by MSSQL Server Process Indicating Webshell

Malicious MOVEit Transfer Exploitation via X-siLock HTTP Headers (via webserver)

Malicious IIS w3wp Worker Spawning Command Interpreter via SharePoint Web Shell

Suspicious Single-Character Named Executable Launched by Web Server Process (via process_creation)

Malicious MOVEit human2.aspx Web Shell Dropped in wwwroot (via file_event)

Malicious IIS Worker Process Spawning PowerShell via Gladinet CentreStack Exploit

SAP NetViewer Webshell Command Execution via JSP cmd Parameter

Pivot detection · T1190 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

webserver-detections-for-sap-netviewer-jsp-webshell-command-execution-via-cmd-pa-94e12f41

title: SAP NetViewer Webshell Command Execution via JSP cmd Parameter
id: 3076c4f5-d1ea-4626-bb57-b0b21ad33a74
status: experimental
description: This rule flags HTTP requests to SAP NetViewer paths containing /irj/ and .jsp where the query string includes command-execution parameters (such as cmd=, command=, exec_cmd=, or exec=). It further narrows matches to suspicious command strings and patterns commonly used to test or stage system command execution, including probes for /dev/tcp, /etc/passwd, and basic OS commands (e.g., uname, whoami, ifconfig, ping, pwd) as well as echo and base64 usage. It relies on web server request telemetry fields for the full URI stem and query string (cs-uri-stem and cs-uri-query) to identify these potentially malicious combinations.
references:
  - https://blog.eclecticiq.com/china-nexus-nation-state-actors-exploit-sap-netweaver-cve-2025-31324-to-target-critical-infrastructures
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2025/Exploits/CVE-2025-31324/web_lnx_exploit_cve_2025_31324_sap_netviewer_webshell.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-05-14
tags:
  - attack.persistence
  - attack.t1505.003
  - attack.initial-access
  - attack.t1190
  - detection.emerging-threats
  - cve.2025-31324
logsource:
  category: webserver
detection:
  selection_uri:
    cs-uri-stem|contains|all:
      - /irj/
      - .jsp
  selection_query:
    - cs-uri-query|startswith:
        - cmd=
        - command=
        - exec_cmd=
        - exec=
    - cs-uri-query|contains:
        - /dev/tcp
        - /etc/passwd
        - "%2fdev%2ftcp"
        - "%2fetc%2fpasswd"
        - =uname
        - =whoami
        - ifconfig
        - ping
        - pwd
    - cs-uri-query|contains|all:
        - echo
        - base64
  condition: all of selection_*
falsepositives:
  - Legitimate applications using cmd parameter for non-malicious purposes
level: high
license: DRL-1.1
related:
  - id: 94e12f41-6cb3-45c5-97b1-c783a7bf2e72
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL