Potential SAP NetWeaver Webshell Creation

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•26

Detects the creation of suspicious files (jsp, java, class) in specific SAP NetWeaver directories. This activity may indicate an attempt to establish a webshell or exploit vulnerabilities, such as CVE-2025-31324, to gain persistent access or execute arbitrary code within the SAP environment.