Potential SAP NetViewer Webshell Command Execution

Status: experimental
Severity: high
Log source: category webserver
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects potential command execution via webshell in SAP NetViewer through JSP files with cmd parameter. This rule is created to detect exploitation of vulnerabilities like CVE-2025-31324, which allows remote code execution via a webshell.

Known false positives

Legitimate applications using cmd parameter for non-malicious purposes

MITRE ATT&CK coverage

Tactic	Techniques
Initial Access	`T1190` Exploit Public-Facing Application
Persistence	`T1505.003` Server Software Component: Web Shell

Rule body

title: Potential SAP NetViewer Webshell Command Execution
id: 94e12f41-6cb3-45c5-97b1-c783a7bf2e72
status: experimental
description: |
    Detects potential command execution via webshell in SAP NetViewer through JSP files with cmd parameter.
    This rule is created to detect exploitation of vulnerabilities like CVE-2025-31324, which allows remote code execution via a webshell.
references:
    - https://blog.eclecticiq.com/china-nexus-nation-state-actors-exploit-sap-netweaver-cve-2025-31324-to-target-critical-infrastructures
author: Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2025-05-14
tags:
    - attack.persistence
    - attack.t1505.003
    - attack.initial-access
    - attack.t1190
    - detection.emerging-threats
    - cve.2025-31324
logsource:
    category: webserver
detection:
    selection_uri:
        cs-uri-stem|contains|all:
            - '/irj/'
            - '.jsp'
    selection_query:
        - cs-uri-query|startswith:
              - 'cmd='
              - 'command='
              - 'exec_cmd='
              - 'exec='
        - cs-uri-query|contains:
              - '/dev/tcp'
              - '/etc/passwd'
              - '%2fdev%2ftcp' # URL encoded of /dev/tcp
              - '%2fetc%2fpasswd' # URL encoded of /etc/passwd
              - '=uname'
              - '=whoami'
              - 'ifconfig'
              - 'ping'
              - 'pwd'
        - cs-uri-query|contains|all:
              - 'echo'
              - 'base64'
    condition: all of selection_*
falsepositives:
    - Legitimate applications using cmd parameter for non-malicious purposes
level: high

Stages and Predicates

Stage 0: `condition`

all of selection_*

Stage 1: `selection_uri`

selection_uri:
    cs-uri-stem|contains|all:
        - '/irj/'
        - '.jsp'

Stage 2: `selection_query`

selection_query:
    - cs-uri-query|startswith:
          - 'cmd='
          - 'command='
          - 'exec_cmd='
          - 'exec='
    - cs-uri-query|contains:
          - '/dev/tcp'
          - '/etc/passwd'
          - '%2fdev%2ftcp'
          - '%2fetc%2fpasswd'
          - '=uname'
          - '=whoami'
          - 'ifconfig'
          - 'ping'
          - 'pwd'
    - cs-uri-query|contains|all:
          - 'echo'
          - 'base64'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`cs-uri-query`	match	`%2fdev%2ftcp` `%2fetc%2fpasswd` `/dev/tcp` `/etc/passwd` `=uname` `=whoami` `base64` `echo` `ifconfig` `ping` `pwd`	`field:"cs-uri-query" kind:match`
`cs-uri-query`	starts_with	`cmd=` `command=` `exec=` `exec_cmd=`	`field:"cs-uri-query" kind:starts_with`
`cs-uri-stem`	match	`.jsp` `/irj/`	`field:"cs-uri-stem" kind:match`