Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8 detections
Filters
Last updated
All Time
Detection languages
6
1
1
Contributors
6
1
1
Categories
6
4
3
2
2
Platforms
4
2
2
Products / Services
2
2
2
2
2
MITRE Techniques
7
7
4
4
3
CVEs
71
71
64
58
49
IDS Classtypes
1
IDS Protocols
1
This rule detects an attempt to exploit a critical vulnerability (CVE-2025-31324) in SAP NetWeaver Visual Composer's Metadata Uploader. The exploit leverages unauthenticated HTTP GET or HEAD requests to the '/developmentserver/metadatauploader' URI, combined with specific characters in the URI parameters (semicolon, dollar sign, backtick, pipe, or their URL-encoded equivalents) that indicate an attempt to execute arbitrary commands. This vulnerability allows an unauthenticated attacker to achieve remote command execution on the affected SAP system.
Detects suspicious child processes spawned by SAP NetWeaver that could indicate potential exploitation of a vulnerability, such as CVE-2025-31324, allowing arbitrary code execution via webshells. The rule specifically looks for common command-line interpreters and scripting engines being launched from SAP NetWeaver's application directories.
Detects suspicious child processes spawned by SAP NetWeaver on Linux systems that could indicate potential exploitation of a vulnerability that allows arbitrary execution via webshells, such as CVE-2025-31324. The rule looks for common shell interpreters, scripting languages, and network utilities being executed from specific SAP NetWeaver directories.
Detects the creation of suspicious files (jsp, java, class) in SAP NetWeaver directories, which may indicate exploitation attempts of vulnerabilities such as CVE-2025-31324, potentially leading to webshell deployment.
Detects the creation of suspicious files (jsp, java, class) in specific SAP NetWeaver directories. This activity may indicate an attempt to establish a webshell or exploit vulnerabilities, such as CVE-2025-31324, to gain persistent access or execute arbitrary code within the SAP environment.
Detects potential Java webshell uploads to an SAP NetViewer server via HTTP POST requests with a 'Content-Type' of 'application/octet-stream' and URI stems containing '/irj/' and ending with '.jsp', '.class', or '.java'. This behavior might indicate exploitation of vulnerabilities like CVE-2025-31324, which allows remote code execution through webshells.
Detects potential command execution via webshell in SAP NetViewer through JSP files with 'cmd' or similar parameters. This rule is designed to identify exploitation of vulnerabilities like CVE-2025-31324, which allows remote code execution via a webshell by looking for specific URI patterns and query parameters indicative of command execution attempts, including common Linux commands and base64 encoded commands.
Detects potential exploitation attempts targeting CVE-2025-31324, a critical unauthenticated file upload vulnerability in SAP NetWeaver Visual Composer. This flaw allows remote attackers to send specially crafted POST requests to the /developmentserver/metadatauploader endpoint, enabling arbitrary file uploads—commonly webshells—resulting in full system compromise. The detection looks for HTTP HEAD or POST requests with a 200 OK status to sensitive Visual Composer endpoints, which may indicate reconnaissance or active exploitation. Successful exploitation can lead to attackers gaining privileged access, deploying malware, and impacting business-critical SAP resources. Immediate patching and investigation of suspicious activity are strongly recommended, as this vulnerability is being actively exploited in the wild.
