Potential Java WebShell Upload to SAP NetViewer Server

SigmaHQ Detections@sigmaHQ

•updated Jun 11, 2025•1•0•37

Detects potential Java webshell uploads to an SAP NetViewer server via HTTP POST requests with a 'Content-Type' of 'application/octet-stream' and URI stems containing '/irj/' and ending with '.jsp', '.class', or '.java'. This behavior might indicate exploitation of vulnerabilities like CVE-2025-31324, which allows remote code execution through webshells.