Potential SAP NetWeaver Webshell Creation - Linux

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•31

Detects the creation of suspicious files (jsp, java, class) in SAP NetWeaver directories, which may indicate exploitation attempts of vulnerabilities such as CVE-2025-31324, potentially leading to webshell deployment.