Suspicious Child Process of SAP NetWeaver - Linux

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•34

Detects suspicious child processes spawned by SAP NetWeaver on Linux systems that could indicate potential exploitation of a vulnerability that allows arbitrary execution via webshells, such as CVE-2025-31324. The rule looks for common shell interpreters, scripting languages, and network utilities being executed from specific SAP NetWeaver directories.