Potential SAP NetWeaver WebShell Creation

  1[metadata]
  2creation_date = "2025/04/26"
  3integration = ["endpoint"]
  4maturity = "production"
  5updated_date = "2026/09/18"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Identifies suspicious Java file creation in the IRJ directory of the SAP NetWeaver application. This may indicate an attempt to deploy a webshell.
 11"""
 12from = "now-9m"
 13index = ["auditbeat-*", "logs-endpoint.events.file*"]
 14language = "eql"
 15license = "Elastic License v2"
 16name = "Potential SAP NetWeaver WebShell Creation"
 17references = [
 18    "https://reliaquest.com/blog/threat-spotlight-reliaquest-uncovers-vulnerability-behind-sap-netweaver-compromise/",
 19    "https://onapsis.com/blog/active-exploitation-of-sap-vulnerability-cve-2025-31324/"
 20]
 21risk_score = 73
 22rule_id = "f7d588ba-e4b0-442e-879d-7ec39fbd69c5"
 23severity = "high"
 24tags = [
 25    "Domain: Endpoint",
 26    "OS: Linux",
 27    "OS: Windows",
 28    "Use Case: Threat Detection",
 29    "Tactic: Execution",
 30    "Use Case: Vulnerability",
 31    "Data Source: Elastic Defend",
 32    "Resources: Investigation Guide",
 33    "Noise: Low",
 34    "Performance: Normal",
 35    "Profile: Recommended",
 36    "Threat: Web Shell",
 37    "Rule Type: Event Correlation (EQL)",
 38    "Platform: Windows",
 39    "Platform: Linux",
 40]
 41timestamp_override = "event.ingested"
 42type = "eql"
 43
 44query = '''
 45file where host.os.type in ("linux", "windows") and event.action == "creation" and
 46 file.extension : ("jsp", "java", "class") and
 47 file.path : ("/*/sap.com/*/servlet_jsp/irj/root/*",
 48              "/*/sap.com/*/servlet_jsp/irj/work/*",
 49              "?:\\*\\sap.com\\*\\servlet_jsp\\irj\\root\\*",
 50              "?:\\*\\sap.com\\*\\servlet_jsp\\irj\\work\\*")
 51'''
 52note = """## Triage and analysis
 53
 54### Investigating Potential SAP NetWeaver WebShell Creation
 55
 56### Possible investigation steps
 57
 58- Examine the file creation event and the associated HTTP post request logs details to identify the source of the creation.
 59- Examine the process tree to verify the parent-child relationship between the Java process and any suspicious child processes such as shell scripts or scripting languages (e.g., sh, bash, curl, python).
 60- Check the command line arguments and environment variables of the suspicious child processes to identify any potentially malicious payloads or commands being executed.
 61- Investigate the host's recent activity and logs for any other indicators of compromise or unusual behavior that might correlate with the suspected exploitation attempt.
 62- Assess the system for any unauthorized changes or new files that may have been introduced as a result of the exploitation attempt, focusing on JSP files under the IRJ root directory.
 63
 64
 65### Response and remediation
 66
 67- Immediately isolate the affected host from the network to prevent further outbound connections and potential lateral movement.
 68- Terminate any suspicious Java processes identified in the alert, especially those making outbound connections to LDAP, RMI, or DNS ports.
 69- Conduct a thorough review of the affected system for any unauthorized changes or additional malicious processes, focusing on child processes like shell scripts or scripting languages.
 70- Restore the affected system from a known good backup if unauthorized changes or malware are detected.
 71- Update and patch Java and any related applications to the latest versions to mitigate known vulnerabilities.
 72- Escalate the incident to the security operations center (SOC) or incident response team for further investigation and to assess the potential impact on other systems within the network."""
 73
 74
 75[[rule.threat]]
 76framework = "MITRE ATT&CK"
 77
 78[[rule.threat.technique]]
 79id = "T1059"
 80name = "Command and Scripting Interpreter"
 81reference = "https://attack.mitre.org/techniques/T1059/"
 82
 83[[rule.threat.technique.subtechnique]]
 84id = "T1059.007"
 85name = "JavaScript"
 86reference = "https://attack.mitre.org/techniques/T1059/007/"
 87
 88[[rule.threat.technique]]
 89id = "T1203"
 90name = "Exploitation for Client Execution"
 91reference = "https://attack.mitre.org/techniques/T1203/"
 92
 93[rule.threat.tactic]
 94id = "TA0002"
 95name = "Execution"
 96reference = "https://attack.mitre.org/tactics/TA0002/"
 97
 98[[rule.threat]]
 99framework = "MITRE ATT&CK"
100
101[[rule.threat.technique]]
102id = "T1505"
103name = "Server Software Component"
104reference = "https://attack.mitre.org/techniques/T1505/"
105
106[[rule.threat.technique.subtechnique]]
107id = "T1505.003"
108name = "Web Shell"
109reference = "https://attack.mitre.org/techniques/T1505/003/"
110
111[rule.threat.tactic]
112id = "TA0003"
113name = "Persistence"
114reference = "https://attack.mitre.org/tactics/TA0003/"