SAP NetViewer Webshell Command Execution via JSP cmd Parameter
Alerts on SAP NetViewer JSP requests likely used as webshells to execute system commands via cmd-style query parameters.
- Category
- webserver
- Author
- Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2025-05-14
- Updated
- 2026-07-31
ATT&CK techniques
Initial Access → PersistenceRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags HTTP requests to SAP NetViewer paths containing /irj/ and .jsp where the query string includes command-execution parameters (such as cmd=, command=, exec_cmd=, or exec=). It further narrows matches to suspicious command strings and patterns commonly used to test or stage system command execution, including probes for /dev/tcp, /etc/passwd, and basic OS commands (e.g., uname, whoami, ifconfig, ping, pwd) as well as echo and base64 usage. It relies on web server request telemetry fields for the full URI stem and query string (cs-uri-stem and cs-uri-query) to identify these potentially malicious combinations.
Reporting behind it
- blog.eclecticiq.comhttps://blog.eclecticiq.com/china-nexus-nation-state-actors-exploit-sap-netweaver-cve-2025-31324-to-target-critical-infrastructures
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2025/Exploits/CVE-2025-31324/web_lnx_exploit_cve_2025_31324_sap_netviewer_webshell.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: SAP NetViewer Webshell Command Execution via JSP cmd Parameter
id: 3076c4f5-d1ea-4626-bb57-b0b21ad33a74
status: experimental
description: This rule flags HTTP requests to SAP NetViewer paths containing /irj/ and .jsp where the query string includes command-execution parameters (such as cmd=, command=, exec_cmd=, or exec=). It further narrows matches to suspicious command strings and patterns commonly used to test or stage system command execution, including probes for /dev/tcp, /etc/passwd, and basic OS commands (e.g., uname, whoami, ifconfig, ping, pwd) as well as echo and base64 usage. It relies on web server request telemetry fields for the full URI stem and query string (cs-uri-stem and cs-uri-query) to identify these potentially malicious combinations.
references:
- https://blog.eclecticiq.com/china-nexus-nation-state-actors-exploit-sap-netweaver-cve-2025-31324-to-target-critical-infrastructures
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2025/Exploits/CVE-2025-31324/web_lnx_exploit_cve_2025_31324_sap_netviewer_webshell.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-05-14
tags:
- attack.persistence
- attack.t1505.003
- attack.initial-access
- attack.t1190
- detection.emerging-threats
- cve.2025-31324
logsource:
category: webserver
detection:
selection_uri:
cs-uri-stem|contains|all:
- /irj/
- .jsp
selection_query:
- cs-uri-query|startswith:
- cmd=
- command=
- exec_cmd=
- exec=
- cs-uri-query|contains:
- /dev/tcp
- /etc/passwd
- "%2fdev%2ftcp"
- "%2fetc%2fpasswd"
- =uname
- =whoami
- ifconfig
- ping
- pwd
- cs-uri-query|contains|all:
- echo
- base64
condition: all of selection_*
falsepositives:
- Legitimate applications using cmd parameter for non-malicious purposes
level: high
license: DRL-1.1
related:
- id: 94e12f41-6cb3-45c5-97b1-c783a7bf2e72
type: derived