Potential SAP NetViewer Webshell Command Execution

SigmaHQ Detections@sigmaHQ

•updated Jun 11, 2025•0•29

Detects potential command execution via webshell in SAP NetViewer through JSP files with 'cmd' or similar parameters. This rule is designed to identify exploitation of vulnerabilities like CVE-2025-31324, which allows remote code execution via a webshell by looking for specific URI patterns and query parameters indicative of command execution attempts, including common Linux commands and base64 encoded commands.