Webserver Java WebShell Upload Attempts via POST to SAP NetViewer URIs

Alerts on POST requests to /irj/ endpoints uploading Java extension files with octet-stream content type.

FreeUnreviewedSigmahighv1

webserver-java-webshell-upload-attempts-via-post-to-sap-netviewer-uris-639b893f

title: Webserver Java WebShell Upload Attempts via POST to SAP NetViewer URIs
id: 7c5f5ca3-458b-420a-8a3c-de08d51038b3
status: experimental
description: This rule flags HTTP POST requests that target SAP NetViewer-related paths containing "/irj/" and Java-related extensions. It focuses on responses sent with Content-Type set to "application/octet-stream", which can align with file upload behavior used to place webshells on a web-accessible system. Such activity is important because unauthorized server-side code upload can enable persistent remote command execution. Detection relies on web server request telemetry including method, URI stem, and Content-Type values.
references:
  - https://blog.eclecticiq.com/china-nexus-nation-state-actors-exploit-sap-netweaver-cve-2025-31324-to-target-critical-infrastructures
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2025/Exploits/CVE-2025-31324/web_lnx_exploit_cve_2025_31324_sap_netviewer_webshell_uploaded.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-05-14
tags:
  - attack.persistence
  - attack.t1505.003
  - detection.emerging-threats
  - cve.2025-31324
logsource:
  category: webserver
detection:
  selection:
    cs-content-type: application/octet-stream
    cs-method: POST
    cs-uri-stem|contains|all:
      - /irj/
      - .jsp
    cs-uri-stem|endswith:
      - .class
      - .java
      - .jsp
  condition: selection
falsepositives:
  - Legitimate uploads of Java files in development environments
level: high
license: DRL-1.1
related:
  - id: 639b893f-f93a-4e53-a7c8-f08cf73fe7f7
    type: derived

What it detects

This rule flags HTTP POST requests that target SAP NetViewer-related paths containing "/irj/" and Java-related extensions. It focuses on responses sent with Content-Type set to "application/octet-stream", which can align with file upload behavior used to place webshells on a web-accessible system. Such activity is important because unauthorized server-side code upload can enable persistent remote command execution. Detection relies on web server request telemetry including method, URI stem, and Content-Type values.

Known false positives

Legitimate uploads of Java files in development environments

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.