Suspicious Child Process of SAP NetWeaver

 1title: Suspicious Child Process of SAP NetWeaver
 2id: 5b304bcb-ac33-49d0-87af-fa1b3ca94333
 3status: experimental
 4description: |
 5    Detects suspicious child processes spawned by SAP NetWeaver that could indicate potential
 6    exploitation of vulnerability that allows arbitrary execution via webshells such as CVE-2025-31324.    
 7author: Elastic (idea), Swachchhanda Shrawan Poudel (Nextron Systems)
 8date: 2025-04-28
 9tags:
10    - attack.execution
11    - attack.initial-access
12    - attack.t1190
13    - attack.persistence
14    - attack.t1059.003
15    - cve.2025-31324
16    - detection.emerging-threats
17references:
18    - https://reliaquest.com/blog/threat-spotlight-reliaquest-uncovers-vulnerability-behind-sap-netweaver-compromise/
19    - https://onapsis.com/blog/active-exploitation-of-sap-vulnerability-cve-2025-31324/
20logsource:
21    category: process_creation
22    product: windows
23detection:
24    selection_parent_img:
25        ParentImage|contains:
26            - '\j2ee\cluster\apps\sap.com\irj\servlet_jsp\irj\work'
27            - '\j2ee\cluster\apps\sap.com\irj\servlet_jsp\irj\root'
28    selection_current_dict:
29        CurrentDirectory|contains:
30            - '\j2ee\cluster\apps\sap.com\irj\servlet_jsp\irj\work'
31            - '\j2ee\cluster\apps\sap.com\irj\servlet_jsp\irj\root'
32    selection_child:
33        Image|endswith:
34            - '\cmd.exe'
35            - '\powershell.exe'
36            - '\powershell_ise.exe'
37            - '\pwsh.exe'
38            - '\wscript.exe'
39            - '\cscript.exe'
40            - '\regsvr32.exe'
41            - '\rundll32.exe'
42            - '\mshta.exe'
43            - '\certutil.exe'
44            - '\bitsadmin.exe'
45            - '\python.exe'
46    condition: (selection_parent_img or selection_current_dict) and selection_child
47falsepositives:
48    - Legitimate administrative activities such as software updates
49level: medium