Windows File Events: Suspicious SAP NetWeaver JSP/Java/Class File Creation

Flags Windows file creation of JSP/Java/Class under SAP NetWeaver servlet_jsp work/root paths that may indicate webshell persistence.

FreeUnreviewedSigmamediumv1

windows-file-events-suspicious-sap-netweaver-jsp-java-class-file-creation-86a7c91f

title: "Windows File Events: Suspicious SAP NetWeaver JSP/Java/Class File Creation"
id: 8d46bfae-0873-4663-852e-5014367a8d57
status: experimental
description: This rule identifies creation of files with .jsp, .java, or .class extensions within specific SAP NetWeaver irj servlet_jsp work/root directories on Windows. Such file placement can indicate webshell or code-persistence attempts following exploitation. It relies on file event telemetry that provides the target filename path and extension for newly created or modified files.
references:
  - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-31324
  - https://reliaquest.com/blog/threat-spotlight-reliaquest-uncovers-vulnerability-behind-sap-netweaver-compromise/
  - https://onapsis.com/blog/active-exploitation-of-sap-vulnerability-cve-2025-31324/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2025/Exploits/CVE-2025-31324/file_event_win_sap_netweaver_webshell_creation.yml
author: Elastic (idea), Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-04-28
tags:
  - attack.execution
  - attack.initial-access
  - attack.t1190
  - attack.persistence
  - attack.t1059.003
  - cve.2025-31324
  - detection.emerging-threats
logsource:
  product: windows
  category: file_event
detection:
  selection_path:
    TargetFilename|contains:
      - \j2ee\cluster\apps\sap.com\irj\servlet_jsp\irj\work
      - \j2ee\cluster\apps\sap.com\irj\servlet_jsp\irj\root
  selection_ext:
    TargetFilename|endswith:
      - .jsp
      - .java
      - .class
  condition: all of selection_*
falsepositives:
  - Legitimate creation of jsc or java files in these locations
level: medium
license: DRL-1.1
related:
  - id: 86a7c91f-98c3-4f14-a58d-d989421e1234
    type: derived

What it detects

This rule identifies creation of files with .jsp, .java, or .class extensions within specific SAP NetWeaver irj servlet_jsp work/root directories on Windows. Such file placement can indicate webshell or code-persistence attempts following exploitation. It relies on file event telemetry that provides the target filename path and extension for newly created or modified files.

Known false positives

Legitimate creation of jsc or java files in these locations

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.