Windows File Events: SAP NetWeaver Directory Webshell File Creation (.jsp/.java/.class)

Flags Windows file creation of JSP/Java/Class under SAP NetWeaver servlet_jsp work/root paths that may indicate webshell persistence.

FreeReviewedSigma · Medium · v5

Product: windows
Category: file_event
Author: Elastic (idea), Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2025-04-28
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Initial Access → Execution

Recon
Resource Dev
Initial Access
- T1190Exploit Public-Facing Application
Execution
- T1059.003Windows Command Shell
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags the creation of files with .jsp, .java, or .class extensions within specific SAP NetWeaver servlet work/root directories on Windows. Attackers may use these file types in these paths to establish or expand web-based access on the host. It relies on Windows file event telemetry containing TargetFilename values that match the targeted directory substrings and the specified extensions.

Reporting behind it

Related detections9 linkedT1059.003 — drag to rearrange

Malicious IIS Worker Spawning nslookup via WS_FTP Deserialization

Suspicious Reconnaissance Commands Spawned by Samsung MagicINFO Server

Suspicious SolarWinds Web Help Desk Java Process Spawning Command Shell (via process_creation)

MSSQL Server Process Spawning Command Shell via xp_cmdshell

Malicious Command Shell Spawned by Wing FTP Server Process

Suspicious MSSQL xp_cmdshell OS Command Execution via sqlservr.exe (via process_creation)

Windows Process Creation: CrushFTP spawning PowerShell, CMD, and scripting tool execution

Windows: Suspicious Command-Line Child Processes Spawned by SAP NetWeaver Paths

Linux File Events: Webshell-like JSP/Java/Class Creation in SAP NetWeaver Directories

Windows File Events: SAP NetWeaver Directory Webshell File Creation (.jsp/.java/.class)

Pivot detection · T1059.003 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-file-events-suspicious-sap-netweaver-jsp-java-class-file-creation-86a7c91f

title: "Windows File Events: SAP NetWeaver Directory Webshell File Creation (.jsp/.java/.class)"
id: 8d46bfae-0873-4663-852e-5014367a8d57
status: experimental
description: This rule flags the creation of files with .jsp, .java, or .class extensions within specific SAP NetWeaver servlet work/root directories on Windows. Attackers may use these file types in these paths to establish or expand web-based access on the host. It relies on Windows file event telemetry containing TargetFilename values that match the targeted directory substrings and the specified extensions.
references:
  - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-31324
  - https://reliaquest.com/blog/threat-spotlight-reliaquest-uncovers-vulnerability-behind-sap-netweaver-compromise/
  - https://onapsis.com/blog/active-exploitation-of-sap-vulnerability-cve-2025-31324/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2025/Exploits/CVE-2025-31324/file_event_win_sap_netweaver_webshell_creation.yml
author: Elastic (idea), Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-04-28
tags:
  - attack.execution
  - attack.initial-access
  - attack.t1190
  - attack.persistence
  - attack.t1059.003
  - cve.2025-31324
  - detection.emerging-threats
logsource:
  product: windows
  category: file_event
detection:
  selection_path:
    TargetFilename|contains:
      - \j2ee\cluster\apps\sap.com\irj\servlet_jsp\irj\work
      - \j2ee\cluster\apps\sap.com\irj\servlet_jsp\irj\root
  selection_ext:
    TargetFilename|endswith:
      - .jsp
      - .java
      - .class
  condition: all of selection_*
falsepositives:
  - Legitimate creation of jsc or java files in these locations
level: medium
license: DRL-1.1
related:
  - id: 86a7c91f-98c3-4f14-a58d-d989421e1234
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL