Suspicious Child Process of SAP NetWeaver

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•36

Detects suspicious child processes spawned by SAP NetWeaver that could indicate potential exploitation of a vulnerability, such as CVE-2025-31324, allowing arbitrary code execution via webshells. The rule specifically looks for common command-line interpreters and scripting engines being launched from SAP NetWeaver's application directories.