Windows File Events: SAP NetWeaver Directory Webshell File Creation (.jsp/.java/.class)
Flags Windows file creation of JSP/Java/Class under SAP NetWeaver servlet_jsp work/root paths that may indicate webshell persistence.
- Product
- windows
- Category
- file_event
- Author
- Elastic (idea), Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2025-04-28
- Updated
- 2026-07-31
ATT&CK techniques
Initial Access → ExecutionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags the creation of files with .jsp, .java, or .class extensions within specific SAP NetWeaver servlet work/root directories on Windows. Attackers may use these file types in these paths to establish or expand web-based access on the host. It relies on Windows file event telemetry containing TargetFilename values that match the targeted directory substrings and the specified extensions.
Reporting behind it
- cve.mitre.orghttps://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-31324
- reliaquest.comhttps://reliaquest.com/blog/threat-spotlight-reliaquest-uncovers-vulnerability-behind-sap-netweaver-compromise/
- onapsis.comhttps://onapsis.com/blog/active-exploitation-of-sap-vulnerability-cve-2025-31324/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2025/Exploits/CVE-2025-31324/file_event_win_sap_netweaver_webshell_creation.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows File Events: SAP NetWeaver Directory Webshell File Creation (.jsp/.java/.class)"
id: 8d46bfae-0873-4663-852e-5014367a8d57
status: experimental
description: This rule flags the creation of files with .jsp, .java, or .class extensions within specific SAP NetWeaver servlet work/root directories on Windows. Attackers may use these file types in these paths to establish or expand web-based access on the host. It relies on Windows file event telemetry containing TargetFilename values that match the targeted directory substrings and the specified extensions.
references:
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-31324
- https://reliaquest.com/blog/threat-spotlight-reliaquest-uncovers-vulnerability-behind-sap-netweaver-compromise/
- https://onapsis.com/blog/active-exploitation-of-sap-vulnerability-cve-2025-31324/
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2025/Exploits/CVE-2025-31324/file_event_win_sap_netweaver_webshell_creation.yml
author: Elastic (idea), Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-04-28
tags:
- attack.execution
- attack.initial-access
- attack.t1190
- attack.persistence
- attack.t1059.003
- cve.2025-31324
- detection.emerging-threats
logsource:
product: windows
category: file_event
detection:
selection_path:
TargetFilename|contains:
- \j2ee\cluster\apps\sap.com\irj\servlet_jsp\irj\work
- \j2ee\cluster\apps\sap.com\irj\servlet_jsp\irj\root
selection_ext:
TargetFilename|endswith:
- .jsp
- .java
- .class
condition: all of selection_*
falsepositives:
- Legitimate creation of jsc or java files in these locations
level: medium
license: DRL-1.1
related:
- id: 86a7c91f-98c3-4f14-a58d-d989421e1234
type: derived