Webserver POST Uploads Java Web Shell Files in SAP NetViewer
Alerts on POST requests to /irj/ endpoints uploading Java extension files with octet-stream content type.
- Category
- webserver
- Author
- Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2025-05-14
- Updated
- 2026-07-31
ATT&CK techniques
PersistenceRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags HTTP POST requests where the response content type indicates raw binary data (application/octet-stream) and the requested URI path targets Java web shell file types (.jsp, .java, .class) within /irj/. Attackers often use web shell uploads to establish persistent remote code execution capability. The detection relies on webserver request telemetry, including HTTP method, Content-Type, and the URI stem patterns from incoming requests.
Reporting behind it
- blog.eclecticiq.comhttps://blog.eclecticiq.com/china-nexus-nation-state-actors-exploit-sap-netweaver-cve-2025-31324-to-target-critical-infrastructures
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2025/Exploits/CVE-2025-31324/web_lnx_exploit_cve_2025_31324_sap_netviewer_webshell_uploaded.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Webserver POST Uploads Java Web Shell Files in SAP NetViewer
id: 7c5f5ca3-458b-420a-8a3c-de08d51038b3
status: experimental
description: This rule flags HTTP POST requests where the response content type indicates raw binary data (application/octet-stream) and the requested URI path targets Java web shell file types (.jsp, .java, .class) within /irj/. Attackers often use web shell uploads to establish persistent remote code execution capability. The detection relies on webserver request telemetry, including HTTP method, Content-Type, and the URI stem patterns from incoming requests.
references:
- https://blog.eclecticiq.com/china-nexus-nation-state-actors-exploit-sap-netweaver-cve-2025-31324-to-target-critical-infrastructures
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2025/Exploits/CVE-2025-31324/web_lnx_exploit_cve_2025_31324_sap_netviewer_webshell_uploaded.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-05-14
tags:
- attack.persistence
- attack.t1505.003
- detection.emerging-threats
- cve.2025-31324
logsource:
category: webserver
detection:
selection:
cs-content-type: application/octet-stream
cs-method: POST
cs-uri-stem|contains|all:
- /irj/
- .jsp
cs-uri-stem|endswith:
- .class
- .java
- .jsp
condition: selection
falsepositives:
- Legitimate uploads of Java files in development environments
level: high
license: DRL-1.1
related:
- id: 639b893f-f93a-4e53-a7c8-f08cf73fe7f7
type: derived