cve.2025-31324

Potential SAP NetWeaver Webshell Creation

Oct 1, 2025 · attack.initial-access attack.t1190 attack.persistence attack.t1059.003 cve.2025-31324 detection.emerging-threats ·

Share on:

Detects the creation of suspicious files (jsp, java, class) in SAP NetWeaver directories, which may indicate exploitation attempts of vulnerabilities such as CVE-2025-31324.

Potential SAP NetWeaver Webshell Creation - Linux

Oct 1, 2025 · attack.initial-access attack.t1190 attack.persistence attack.t1059.003 cve.2025-31324 detection.emerging-threats ·

Share on:

Detects the creation of suspicious files (jsp, java, class) in SAP NetWeaver directories, which may indicate exploitation attempts of vulnerabilities such as CVE-2025-31324.

Suspicious Child Process of SAP NetWeaver

Oct 1, 2025 · attack.initial-access attack.t1190 attack.persistence attack.t1059.003 cve.2025-31324 detection.emerging-threats ·

Share on:

Detects suspicious child processes spawned by SAP NetWeaver that could indicate potential exploitation of vulnerability that allows arbitrary execution via webshells such as CVE-2025-31324.

Suspicious Child Process of SAP NetWeaver - Linux

Oct 1, 2025 · attack.initial-access attack.t1190 attack.persistence attack.t1059.003 cve.2025-31324 detection.emerging-threats ·

Share on:

Detects suspicious child processes spawned by SAP NetWeaver on Linux systems that could indicate potential exploitation of vulnerability that allows arbitrary execution via webshells such as CVE-2025-31324.

Potential Java WebShell Upload in SAP NetViewer Server

Jun 11, 2025 · attack.persistence attack.t1505.003 detection.emerging-threats cve.2025-31324 ·

Share on:

Detects potential Java webshell uploads via HTTP requests with Content-Type 'application/octet-stream' and Java file extensions. This behavior might indicate exploitation of vulnerabilities like CVE-2025-31324, which allows remote code execution through webshells in SAP NetViewer.

Potential SAP NetViewer Webshell Command Execution

Jun 11, 2025 · attack.persistence attack.t1505.003 attack.initial-access attack.t1190 detection.emerging-threats cve.2025-31324 ·

Share on:

Detects potential command execution via webshell in SAP NetViewer through JSP files with cmd parameter. This rule is created to detect exploitation of vulnerabilities like CVE-2025-31324, which allows remote code execution via a webshell.